Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/10/2024, 05:36
General
-
Target
db9e43f94895af6bdbdc3bac9fc54d68b0f23f6807e05eb0f5b79a2580c1df7c.exe
-
Size
29KB
-
MD5
948dda535041626edb8b11e6b73a4517
-
SHA1
e9263538016829441548295cbe935010177410e2
-
SHA256
db9e43f94895af6bdbdc3bac9fc54d68b0f23f6807e05eb0f5b79a2580c1df7c
-
SHA512
f0c99d6c089310648a25a1c9f8d28ffaab5ee6a0b0080915271a8841775a87a321c1f431fb912d1eee126c479558e6d07b97654912409cd9a636138f1cb3819c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/sj:AEwVs+0jNDY1qi/qUj
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db9e43f94895af6bdbdc3bac9fc54d68b0f23f6807e05eb0f5b79a2580c1df7c.exe"C:\Users\Admin\AppData\Local\Temp\db9e43f94895af6bdbdc3bac9fc54d68b0f23f6807e05eb0f5b79a2580c1df7c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5051e5cf2b443a889705c9cb2870c6cf0
SHA1591f128636b9cef253abe96aa260737d52b75db6
SHA2568101cd093ceb1177dc666f2df65bb0d2d3ef440c3d91e173dc8f0c38a32ca997
SHA512cfd3fbff7d00801d801fecc9363b1821e322b35cbb0771b856e896022cd3e1ae1e391adc9b696a210eed76aa1e7ef58d8ffc7df5cbbd862fe7bffe1c8a84a571
-
Filesize
384B
MD5a7b1b36e75bc08694047341746a7a822
SHA1b1fb8ba61ea26db5aafa98b0fdc3f165c9a3e4e1
SHA25676da68377a9046f1cb4ad9eea4438f8b44b1edb804f68af155ac507541a2fd29
SHA512862919dfd4b9ed3326227606a3b3ee732f2fbb82b7a08a0aa63bc6c2df77114d1b7d4ca40a9f802a34165603cd032ce5c3123f823726233a1b9c4ac5101b2fee
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB