Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 15:49

General

  • Target

    2f0116e513b4b7bc8552e3d13be9a7ae530eb7c7433a18aa7df96992e77585e8N.exe

  • Size

    29KB

  • MD5

    51686e56e424dda3a35667ef46790310

  • SHA1

    46015d3422d15122ef2fd6d7fcae8ce7ba3c364c

  • SHA256

    2f0116e513b4b7bc8552e3d13be9a7ae530eb7c7433a18aa7df96992e77585e8

  • SHA512

    ff2996b5f23e8fbc3f8db82d5f43502a3ce18595a45508a3e7ddbec2a680300e6219cf2dfcabfb5975d739ba3a2e47c53f6d9383ab4d5e7a4de54284ddef84a8

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/aS:AEwVs+0jNDY1qi/qT

Malware Config

Signatures

  • Detects MyDoom family 5 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f0116e513b4b7bc8552e3d13be9a7ae530eb7c7433a18aa7df96992e77585e8N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f0116e513b4b7bc8552e3d13be9a7ae530eb7c7433a18aa7df96992e77585e8N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA7E.tmp

    Filesize

    29KB

    MD5

    c2c2ab2f01bda2ba922bae51811f93a7

    SHA1

    0b85f388d702867abaac4800824e17608b991bec

    SHA256

    8fbe9df27ff40db1ad3c606867f253054bbc18e1c15f022f8b87bcf427d98ee2

    SHA512

    3acd080d080d7d4fcab67c805e34db0e0c0d1bf93c004ec41d0d356b2a0b95c20603e3c468ae1333446a7a6e9ee44f68e13cfb2bdca263d2c3f543e38e61f59f

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    599c6a315422b5b78dab821e07869ba3

    SHA1

    4916aea1411c1601496cdf0fc1abddc38b931e5d

    SHA256

    811f6f518e88232d27ff84e4c8e73b83b1d2ceb90c0d98fe7c4aadee50695133

    SHA512

    ef1853929e34964b7b0f3c090297bfb5ee94b6d3ee35c422c3288f5bdea777832b45381c942bdccb3ae2886feef03337bfb96710e347b9b911ea7231062a04ff

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2260-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-78-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-45-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2260-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2260-73-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-71-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-8-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2260-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2260-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-39-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-46-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-34-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-22-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-72-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2388-79-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB