Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/10/2024, 08:25
General
-
Target
3d4d6f6c6f51d45c01d2c489dcc597b72b4c298ad7006efa422dd486def3b1cbN.exe
-
Size
29KB
-
MD5
69c4a6d592cc6eb681d53f79888b1a60
-
SHA1
9860e530655e014a7312c21ea49db1f044e53af0
-
SHA256
3d4d6f6c6f51d45c01d2c489dcc597b72b4c298ad7006efa422dd486def3b1cb
-
SHA512
3a7e3e1ed26bb5373e5bf227bfd7b96140766c7397660aa00161d873439d5e57753e4b21c8deed6c1cb6e910c2b074e3385fd4a9701d21193ee94d195ee4591a
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//:AEwVs+0jNDY1qi/q3
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4d6f6c6f51d45c01d2c489dcc597b72b4c298ad7006efa422dd486def3b1cbN.exe"C:\Users\Admin\AppData\Local\Temp\3d4d6f6c6f51d45c01d2c489dcc597b72b4c298ad7006efa422dd486def3b1cbN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5ff61d4a835fcf5592f1edd35f971858e
SHA18cc06541eadcd266b989803704b6dbd0ce7a854b
SHA2567e0b59f3bc11287ddeab376fc8b94047e72f0254db985687e1b336633b2c9ab4
SHA51217bc827bdb16be3c91a493c49cc8f45d724f45521b10a217ac0aee04952045c678447cc053a3e939cb470f0801509312d2570d9c4f43fca659181aebc680ae78
-
Filesize
352B
MD596f1a82a5c3992b4f05238b9c248811c
SHA10ea5b9c54021a5e5e9d9bd6d8ed99b3866b06976
SHA256033b66ec38fd58277f8e1f1ede13c8a454745457d2420b737fd0782fb763b3a3
SHA512cb8bca9db8cae3930cab015ce911fb2245364cf1c96159ad46e43914c72b20136ba026aaf237c598e64cf3142acff07c2bd9dc34dd63ec1ab2a82597a1fafc29
-
Filesize
320B
MD5dbbef91a29808abd8f3eb7a1bccdc1ea
SHA113e4b027b726ddc3f238d4ec18731208b327fecd
SHA256181034a9ddc5f289f9a0524a7277915952e8df5fdac157da86f5ad79879a3976
SHA5120a05c943548b811329b4d166f21d94d67fadc743c814f8bf7771fb4e1115dd00536cda32da71a0ad96596341e9a0f42fe4b3e34ddc423ae4f5671bbbf4a6e6ac
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB