Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27/09/2024, 20:08
General
-
Target
a9092f39739f07dd881dd8f07266da7289eb40042d69da0fe05aaa9074002f90N.exe
-
Size
29KB
-
MD5
98a5e00c3b09f11d2f920d7dc32176a0
-
SHA1
e244790fb34a8cd82d5d46bf188b2f393cf679f4
-
SHA256
a9092f39739f07dd881dd8f07266da7289eb40042d69da0fe05aaa9074002f90
-
SHA512
a6913527b13d16dfe482b8e212d449aecf8db1e051926ea356636eccd63cea3e31692f2d6dcde69a49a3565934aec57bf5e00c9699655c440365d44c0c2adcaa
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/K6:AEwVs+0jNDY1qi/qb
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9092f39739f07dd881dd8f07266da7289eb40042d69da0fe05aaa9074002f90N.exe"C:\Users\Admin\AppData\Local\Temp\a9092f39739f07dd881dd8f07266da7289eb40042d69da0fe05aaa9074002f90N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5fbbd024ed445e7d2033c85ae0257d1a1
SHA18352cf22b87b98444b13bf79711244717257eda4
SHA256be647939e650d53aac2576d8043a580c93baa1e7c007d1e9e6ca5b0bca771e14
SHA512cf3fa0c3b28ed1b8f599ec2131d49e9ed45c0a2fa7bea6bb5708a468162ae7ec73c7bc3ea650fd37bdddcbd447e838ee67cb74370a47df6dd573c24e01edb7c0
-
Filesize
320B
MD50d7c5ddaa4f569355899e3b49f520b07
SHA124f118f655d3a0f88fc543b06f344b15307f2c4a
SHA2563e6f278bdb00ede68e942ec0da9c2149769cc43021ee5dea8d8fb121f32cd181
SHA51216d23f4ca472dd2d51a436bdccfb8de9ec8e90bcbf8164f38fc547165e25b493284a8c851016495d795e020e5c1844622e77336ce516822bdd5ee15cb05c035e
-
Filesize
320B
MD5e4a78a2399cae7858d026a81c2516041
SHA1dd9d73c9066e5e38e149f451924b4d6768ba611d
SHA256021db2a428ba9ecd2c602b8612b640d57c756fff0e9c564f59923ad30f5c1734
SHA512ab5897e208382b33077b8f0a03889d175ad3b069fd7a72a7233552f9fbc5dadf8f903ae373b3002d1e50a25b508d93c86c83e478b82d11a430a52d4df28089a8
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB