Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

00b9b6cf27...f7.exe

windows7-x64

3

00b9b6cf27...f7.exe

windows10-2004-x64

3

05500734fe...81.exe

windows7-x64

05500734fe...81.exe

windows10-2004-x64

0b75e2fadf...c5.exe

windows7-x64

8

0b75e2fadf...c5.exe

windows10-2004-x64

8

0d5fa75218...64.exe

windows7-x64

10

0d5fa75218...64.exe

windows10-2004-x64

10

1760c5727e...9c.exe

windows7-x64

10

1760c5727e...9c.exe

windows10-2004-x64

10

1fe99fb7c5...81.exe

windows7-x64

10

1fe99fb7c5...81.exe

windows10-2004-x64

10

2336173567...98.exe

windows7-x64

10

2336173567...98.exe

windows10-2004-x64

10

2522b83852...03.exe

windows7-x64

10

2522b83852...03.exe

windows10-2004-x64

10

2af6bc16f2...b2.exe

windows7-x64

10

2af6bc16f2...b2.exe

windows10-2004-x64

10

3d9f9c162e...64.exe

windows7-x64

7

3d9f9c162e...64.exe

windows10-2004-x64

7

3db846a796...e5.exe

windows7-x64

10

3db846a796...e5.exe

windows10-2004-x64

10

493813116f...dc.exe

windows7-x64

10

493813116f...dc.exe

windows10-2004-x64

10

4d61a61265...08.exe

windows7-x64

10

4d61a61265...08.exe

windows10-2004-x64

10

510827ce68...c5.exe

windows7-x64

10

510827ce68...c5.exe

windows10-2004-x64

10

5642f8bd3b...2a.exe

windows7-x64

10

5642f8bd3b...2a.exe

windows10-2004-x64

10

6c37d14d5a...4c.exe

windows7-x64

10

6c37d14d5a...4c.exe

windows10-2004-x64

10

Resubmissions

21/08/2024, 19:30 UTC

240821-x76q3sweqg 10

21/08/2024, 17:42 UTC

240821-v92h2avgpj 10

12/06/2024, 16:01 UTC

240612-tgps4a1bqh 10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 19:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe

  • Size

    28KB

  • MD5

    e26570922a9373c1f3a06f647ddd10a4

  • SHA1

    e0f6853e39e0b9fbcb3062bb7e15b8734b9df9f3

  • SHA256

    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c

  • SHA512

    e17a8c1ca8aa6c65106831086f203736b7bdd92c54d2487f381f7d7303a5f3852859935ef55a913dd8856c6015a5f9414308430ae1ff4b5690743025f8ff4c70

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNQ05:Dv8IRRdsxq1DjJcqf8

Score
10/10
mydoomdiscoverypersistenceupxworm

Malware Config

Signatures

  • Detects MyDoom family 4 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Executes dropped EXE 1 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    "C:\Users\Admin\AppData\Local\Temp\1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2432

Network

  • flag-us
    DNS
    alumni.caltech.edu
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
    Response
    alumni.caltech.edu
    IN MX
    alumni-caltech-edumail protectionoutlookcom
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
    Response
    gzip.org
    IN MX
    �
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
  • flag-us
    DNS
    alumni-caltech-edu.mail.protection.outlook.com
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    Response
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.41.3
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.12
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.11.13
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.194.0
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
    Response
    gzip.org
    IN A
    85.187.148.2
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
  • flag-us
    DNS
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
  • 15.124.29.93:1034
    services.exe
    152 B
     3
  • 4.240.75.119:1034
    services.exe
    152 B
     3
  • 172.16.1.249:1034
    services.exe
    152 B
     3
  • 172.16.1.44:1034
    services.exe
    152 B
     3
  • 67.201.226.55:1034
    services.exe
    152 B
     3
  • 16.101.234.0:1034
    services.exe
    152 B
     3
  • 4.240.78.237:1034
    services.exe
    152 B
     3
  • 52.101.41.3:25
    alumni-caltech-edu.mail.protection.outlook.com
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    152 B
     3
  • 85.187.148.2:25
    gzip.org
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    152 B
     3
  • 10.0.0.4:1034
    services.exe
    52 B
     1
  • 204.13.239.180:25
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    64 B
     126 B
     1
    1

    DNS Request

    alumni.caltech.edu

  • 8.8.8.8:53
    gzip.org
    dns
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    162 B
     70 B
     3
    1

    DNS Request

    gzip.org

    DNS Request

    gzip.org

    DNS Request

    gzip.org

  • 8.8.8.8:53
    alumni-caltech-edu.mail.protection.outlook.com
    dns
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    92 B
     156 B
     1
    1

    DNS Request

    alumni-caltech-edu.mail.protection.outlook.com

    DNS Response

    52.101.41.3
    52.101.9.12
    52.101.11.13
    52.101.194.0

  • 8.8.8.8:53
    gzip.org
    dns
    1760c5727e5568d3b18a1cbf0d50c311613699af8233c96fb3eee197f438ce9c.exe
    162 B
     70 B
     3
    1

    DNS Request

    gzip.org

    DNS Request

    gzip.org

    DNS Request

    gzip.org

    DNS Response

    85.187.148.2

  • 8.8.8.8:53

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA1BE.tmp
    Filesize

    28KB

    MD5

    46a8a8cdca9048da2a092d3508ac6f84

    SHA1

    83b1bdc6eb2631131d52a4fc3bb33314a47eff41

    SHA256

    fd4137d0d111d609609b1b35dd451d25e510513c6310363651ccdf70f87f5536

    SHA512

    b201f66f6c4912473de64f21a759c54073e00f7c5d94eff924ec5f00a3eae951c38caa100299237ebf29cc423b38047d4f5ff18e5d6001e164f3d6be2f367733

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    1KB

    MD5

    2fcc3cac739b22dd83c7ff355247a926

    SHA1

    480eaba6e6894ea7b2543758180f4bbba89657e4

    SHA256

    f8ed6c259cec545dbeb708dda70d145fb0e13cc3d7991a6e7e2449c44f758248

    SHA512

    4d763742cfec31c7ede18b5dac8edb678ee186b202d44a035f43048e5c78c26b6e283f4e96f56dff3950cdc9ecf0970259c76139e6ef65a44ad57cb7a1157ac4

    Download Submit

  • C:\Windows\services.exe
    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

    Download Submit

  • memory/2212-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2212-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2212-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2212-87-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2212-78-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2212-59-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2432-41-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-48-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-53-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-36-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-29-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-24-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-84-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2432-88-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.