Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 10:05
Behavioral task
behavioral1
Sample
558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe
Resource
win10v2004-20241007-en
General
-
Target
558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe
-
Size
29KB
-
MD5
99decc1150da4152946b22e60c1153d0
-
SHA1
a76ffb9e4fbacccd2e4a995d38bbc9393290555f
-
SHA256
558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4
-
SHA512
82fc88c19499b8f73addadb267fb60ec401e448b6abd0156a2c1181e614cce6c6e66dc90f0ede865067f4867bbe08b3b70b77f9fbc1b4d332f7a140031767651
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/e/:AEwVs+0jNDY1qi/q+
Malware Config
Signatures
-
Detects MyDoom family 4 IoCs
resource yara_rule behavioral1/memory/2688-15-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral1/memory/2688-51-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral1/memory/2688-53-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral1/memory/2688-77-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom -
Executes dropped EXE 1 IoCs
pid Process 2788 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe -
resource yara_rule behavioral1/memory/2688-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2688-4-0x0000000000220000-0x0000000000228000-memory.dmp upx behavioral1/files/0x00070000000186ee-7.dat upx behavioral1/memory/2688-15-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2788-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-18-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-23-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-30-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-35-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-40-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-42-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2788-47-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-51-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2788-52-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2688-53-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2788-54-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/files/0x0035000000018683-64.dat upx behavioral1/memory/2688-77-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral1/memory/2788-78-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe File opened for modification C:\Windows\java.exe 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe File created C:\Windows\java.exe 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2788 2688 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe 30 PID 2688 wrote to memory of 2788 2688 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe 30 PID 2688 wrote to memory of 2788 2688 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe 30 PID 2688 wrote to memory of 2788 2688 558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe"C:\Users\Admin\AppData\Local\Temp\558b28d0cb44ab724fa43d42bc93d80e42ec113b1e29dddf587f567a29a243e4N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5178c0cfa65ff9edd390ee76ba6292244
SHA1d9adc86676690474ba51108241df51d05df61a6b
SHA256d0e87c3feb7b8391d6760ad805aafeb64f212938c9e1322c01e0c16ef5a2784f
SHA512c8f4e341218f5c87c184b2eadc36ee4f44241d542d94085470432e99f02dc0a5b8f27e9006ae13e22376348a885d5700175c7ad321a937c863d8538c9bbb8e53
-
Filesize
288B
MD51b9c529f6eba688f86e13286aabbd50c
SHA1c0115c74936463f73e849aad92c53df4a9e1a7d9
SHA25615b41d2e12d667a8082debd9d6e04336df53b020e1da13c59673845351f98657
SHA51284506e46355ea88a8350680ba77383dde672c02dab5420c989c88d3ca08af1531801c350eea0befdfd545fedd6b946bf612ba782f12d1dd40e6eb524787d8ce4
-
Filesize
256B
MD5354172ad77c3099756abeea4099af163
SHA191b9df8b7d1d27a67fc20d16897f192290407c74
SHA2560b76405512bf9550ced0f2484ff42a046b4432bb7822efb97baebf4118899c68
SHA512c3288cc873d0ff7d97ff91071079c1535ee6e6621483424efa2587425e870094809a3501471d9c3f4c32989ab51d3065088caebf6efbeb75270235d4bec698c6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2