Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 19:53

General

  • Target

    27bfb8104baabbabd4bf7facf3bc4d0263e87b4c60f0652db49ebe86cbc735e8.exe

  • Size

    29KB

  • MD5

    6e7bd58e5ef36b0fe0572f82506333a2

  • SHA1

    4a2efb2acea362cf536e41e0e238ca8d32fecf5c

  • SHA256

    27bfb8104baabbabd4bf7facf3bc4d0263e87b4c60f0652db49ebe86cbc735e8

  • SHA512

    ab9444ae3354639ced1f987b7cbe4cf759459b502cd7c99a4e803ad6d145cde08c969516682dd13493d589a91c361cbe7a7b148f52fd621e332852244baface0

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/T:AEwVs+0jNDY1qi/q7

Malware Config

Signatures

  • Detects MyDoom family 8 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27bfb8104baabbabd4bf7facf3bc4d0263e87b4c60f0652db49ebe86cbc735e8.exe
    "C:\Users\Admin\AppData\Local\Temp\27bfb8104baabbabd4bf7facf3bc4d0263e87b4c60f0652db49ebe86cbc735e8.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:1912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bf54aa50e7bde28f1cb3d8ca38f11e85

    SHA1

    a6d576e0d489ec5f1774ee559c36ca73e019cc01

    SHA256

    4d7cfd7ec0da233b0ce57fe528ce3395dbd82d935c50f3d9b32fb151db9182dd

    SHA512

    ebf2eb1abd016b39bf3f979582c7fe1fab419ca8416234f74e1044837b558f2636f7d9a39e3f7046e73b1f960777e380486c9d6937bb93b7926cc88b282bb929

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    73167cc225735f346cfea88d57865d96

    SHA1

    2396127247ef4d8e85a1041ff76bfb7789415874

    SHA256

    60fa517b2c5a4eeee8b85ff23ebab5b3670f54f16bdb224a481d0e58e740b771

    SHA512

    78c9c3084fb09a090cb5ec0081b3a9988a8b96f9426fe3ff2fd20a7c1821476167baa8082931ded44bd81c163f22cd372e06ee9f745ecda3da25e19c05a346bc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\search[2].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\default[1].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Temp\CabC389.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC428.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpBC11.tmp

    Filesize

    29KB

    MD5

    d6d0944175652a61066512b5542bf77d

    SHA1

    332f4c4793db37d741299e61c879675331261a48

    SHA256

    0e380350d1c03275db36e07011134715c8ea94261d12494cc1e4508826cb5a72

    SHA512

    79c9a0b1930b2eb73ef6f4f4c5aedf1dc865dcf4bb23bc52dec809f7aac63b75c971a6304be1bc8a3f271a78f68579ca9287b9d39155ea423011a5e7e1f06d61

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    800670674782b08d9c3a759578c648c6

    SHA1

    abcb9897b3c9432bf3f50ff0d05714e7bd669e35

    SHA256

    083e2a523ae34c05b824de336fe26f35c49022210742a7070ceaeba6e034e3d5

    SHA512

    c8b035a009ab93392517cc353762687eacf80fe519ca20477d2783a282ef70619049a9d08768b232e3ce68f82b59266f038a0c261bdbefdec519daa507c10416

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    b4da924f50cae64e8c27adf3d9d39da4

    SHA1

    88f31e9924268b1d6799335e2df7a7bf8a0c8478

    SHA256

    f374814ebb9fcc062c960bc539c3eae914424021a6703be421e27ce219a348ec

    SHA512

    d6a97e0910dae397b45ba2afa5180481a84aff42c34464040e713b559e904728b40a82ef2ffacf974a3db28e5257bd524c56b87532a758deced7601f2ea17002

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1912-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-245-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-76-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-81-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1912-105-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-64-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-80-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-104-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-73-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-8-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3044-68-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-244-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-37-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/3044-3-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB