Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

990aacea86...dN.exe

windows7-x64

10

990aacea86...dN.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 12:19 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe

  • Size

    41KB

  • MD5

    1a0c4e6e0d2a881092029f8faa817d80

  • SHA1

    7564b91ea47541fde68b11fcaf4ff58895c716ba

  • SHA256

    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6d

  • SHA512

    c6a6f3a125039b65361d76d018efa3752c5f413abab9a64c04270a70af8527da90ef7c511d23b5676fa7fec1a35ee09c54e7136ed232a4dda4e00ee485d8931e

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Score
10/10
mydoomdiscoverypersistenceupxworm

Malware Config

Signatures

  • Detects MyDoom family 9 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    "C:\Users\Admin\AppData\Local\Temp\990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2512

Network

  • flag-us
    DNS
    alumni.caltech.edu
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN MX
    Response
    alumni.caltech.edu
    IN MX
    alumni-caltech-edumail protectionoutlookcom
  • flag-us
    DNS
    alumni-caltech-edu.mail.protection.outlook.com
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    Response
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.11.17
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.194.15
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.9.12
    alumni-caltech-edu.mail.protection.outlook.com
    IN A
    52.101.42.13
  • flag-us
    DNS
    gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN MX
    Response
    gzip.org
    IN MX
    �
  • flag-us
    DNS
    gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    gzip.org
    IN A
    Response
    gzip.org
    IN A
    85.187.148.2
  • flag-us
    DNS
    alumni.caltech.edu
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    alumni.caltech.edu
    IN A
    Response
    alumni.caltech.edu
    IN A
    204.13.239.180
  • flag-us
    DNS
    mx.gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.gzip.org
    IN A
    Response
  • flag-us
    DNS
    mail.gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.gzip.org
    IN A
    Response
    mail.gzip.org
    IN CNAME
    gzip.org
    gzip.org
    IN A
    85.187.148.2
  • 10.0.2.15:1034
    services.exe
    152 B
     3
  • 172.16.1.182:1034
    services.exe
    152 B
     3
  • 192.168.2.103:1034
    services.exe
    152 B
     3
  • 172.16.1.164:1034
    services.exe
    152 B
     3
  • 172.16.1.108:1034
    services.exe
    152 B
     3
  • 52.101.11.17:25
    alumni-caltech-edu.mail.protection.outlook.com
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    152 B
     3
  • 85.187.148.2:25
    gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    152 B
     3
  • 172.16.1.161:1034
    services.exe
    152 B
     3
  • 204.13.239.180:25
    alumni.caltech.edu
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    152 B
     3
  • 85.187.148.2:25
    gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    152 B
     3
  • 192.168.2.16:1034
    services.exe
    152 B
     3
  • 85.187.148.2:25
    mail.gzip.org
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    104 B
     2
  • 172.16.1.177:1034
    services.exe
    52 B
     1
  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    64 B
     126 B
     1
    1

    DNS Request

    alumni.caltech.edu

  • 8.8.8.8:53
    alumni-caltech-edu.mail.protection.outlook.com
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    92 B
     156 B
     1
    1

    DNS Request

    alumni-caltech-edu.mail.protection.outlook.com

    DNS Response

    52.101.11.17
    52.101.194.15
    52.101.9.12
    52.101.42.13

  • 8.8.8.8:53
    gzip.org
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

  • 8.8.8.8:53
    gzip.org
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    54 B
     70 B
     1
    1

    DNS Request

    gzip.org

    DNS Response

    85.187.148.2

  • 8.8.8.8:53
    alumni.caltech.edu
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    64 B
     80 B
     1
    1

    DNS Request

    alumni.caltech.edu

    DNS Response

    204.13.239.180

  • 8.8.8.8:53
    mx.gzip.org
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    57 B
     124 B
     1
    1

    DNS Request

    mx.gzip.org

  • 8.8.8.8:53
    mail.gzip.org
    dns
    990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
    59 B
     89 B
     1
    1

    DNS Request

    mail.gzip.org

    DNS Response

    85.187.148.2

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4240.tmp
    Filesize

    41KB

    MD5

    5806b9d81fbc15a13e15ad6b17305ca3

    SHA1

    6a5cd2ccfa5967175ef141d18e5a54fb79867322

    SHA256

    d6447b47b618e6b584ecbc1aed429421429fa3e191db3bbfb22cb88794120d95

    SHA512

    edf78f7298200c9d727a1c494dba126c7c1f5ac8b074af5fccb994c060340ccc76ccfbb245e9a0eb5f9d4be48067b3b650d3f2521362d301eb7f2eb7fdd6e7ca

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    192B

    MD5

    bd8984c7378ee8c94a3a9f2679e48fdf

    SHA1

    e57cb9af26f2bcfb6bd55cf4c8238066ff3fe8c7

    SHA256

    ccea7c3f031c34396dae3be1e6256e2d79cdb74e0e69ea3bc5805f645afc31b8

    SHA512

    91b18782beb9becbcfeaa0d95d48cca88f9e885b6761d0fdc34b1902a76376b9a53acf9a7c8bbf1deac7e8ced5596d57e7030bf97de6f48488fa3a987aa04e7a

    Download Submit

  • C:\Windows\services.exe
    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

    Download Submit

  • memory/1760-78-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1760-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1760-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1760-90-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-85-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-83-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-2-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1760-57-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/1760-55-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

    Download

  • memory/2512-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-39-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-58-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-34-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-46-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-79-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-84-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-22-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2512-91-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.