Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2024, 13:35

General

  • Target

    7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe

  • Size

    41KB

  • MD5

    a37325c7d9a198b82dc3c90fba9af6a0

  • SHA1

    59a4bce32b523d797181013aa3dca5ad622547d1

  • SHA256

    7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06d

  • SHA512

    090bf43ec9eece66a51e10d4fe63e9c9e37d101986122cd14a7481a76fc74a16e2f34ff1df99c6ac72f8e277f509811cc97bbfe5fdff8a62b88fa9abc7b6f243

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Malware Config

Signatures

  • Detects MyDoom family 9 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe
    "C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    58a8975fc9db25c77c674cde2bcaac6f

    SHA1

    fdeb7714ca4be40bd4bc9ae9dd8fbf8e2a56abf5

    SHA256

    c5cdaa7546a9de393b9100c97f2813584753516ec051e5cc544e59b4704f59a9

    SHA512

    221543b8408330bd85b5472fab19a51eea5cec1ac14ad770877c0206ed92fc3628be37e014c92503c31f014f46376b7c5b7956b8644177c0500576b5c92f1839

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    af68e878611d755b4dfd5664f98b7321

    SHA1

    53772fcf143375999565ee6dcb21d3930a07e33a

    SHA256

    ab9c3893744cb4cbb6350be2f5fb18714ff23fb4753dbb4c15d8ebf362982b17

    SHA512

    9eebcd7c555c3548f634714ed061a3732594bbd4ab0e7630bcd6b5f8a8843f9ed1d8de38ff3fab5a3a92f3841529dc01a71be34f1fc2def73c801415bf63da09

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\search[1].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\default[2].htm

    Filesize

    314B

    MD5

    b07e581a2a8817ceb6f3fd2201ab1f88

    SHA1

    5821cfcbe8fd4902e273deae671e19d224122f75

    SHA256

    0e035ede0ac6c36ce4995f1c04d5ae235e43e17ebe25008896349bbf70c46616

    SHA512

    60d45ccf6586f812aaad3c501682be0002b22fe9c395ede044d17ec9392d55a940d852ef546fd2f84edb1eab73fe4424ad6b4ca67befef32360ed8d73bedfe08

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RLHRIIGD\default[1].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VUUZQMCA\default[1].htm

    Filesize

    308B

    MD5

    ccfe63b884fe4225fa33f618a54ce37a

    SHA1

    bbb0778c1597eafe7fb9c5c65412f8ab04b2e311

    SHA256

    f7dd5bab49466a4cdb6a7f5a0e07a158f7a1567bd809ed745812469775b33112

    SHA512

    858f345503c89ba075b374764145fba5b1a9d3440d1628edeab0a3e02cc7cbfbe1119c20747026e69d630ed262d3c91c5073ef06823cf727dfcb11605c7c5ff8

  • C:\Users\Admin\AppData\Local\Temp\Cab503D.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar508E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmp3FAF.tmp

    Filesize

    41KB

    MD5

    17de0b2bb1ee2c3bd54f2bb306c5dbf6

    SHA1

    bd58a14c59186e93e19acbb341a5c6b8790e05e9

    SHA256

    2d95856824cc5059e7ad1c0734be36f744103924be1a52ae6132d331eadd1cc5

    SHA512

    13ebea6fa935abf8731348faa55a6b6c987adc31b9983918146f24db5bd7d93513802c52c0c03b66f9c388e0ad06977112f748addeeb28a98f7e1464bd10658a

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    192B

    MD5

    08bb1ee403e36b680de8f5dd1cd2a0f0

    SHA1

    4a4ab7c6f9715abc2302c1d673361b547f684311

    SHA256

    248f461a9d021fcf931be898b5898ae9b73f045c6a720560d276f316995eb49c

    SHA512

    9571b75fe72e938469db5ed9213247eef37b9b4183ff1005310c016e8d00002615308cfb8b9338aa3f07fab7063ed0baefe9f0288221ba3fa0cfc6548eb0a488

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    192B

    MD5

    8a32ad804bae3ae1a29f7c9760d94c20

    SHA1

    15e8c764665a1d94697febc5030ae8f9a1825265

    SHA256

    db9ad11df47681ba8439a78a4dd6a0aa7439b86caf89a440df80fb321f65e636

    SHA512

    0a8e42cf9e99fedb0f0a36fa775bbc1eb7a0178f444b68452bb7c38e22b181bd4e2827f956c652b6d774995b38787cd6675a02254e95e270e1feb16e04d21d12

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2488-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-55-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-287-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-62-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-67-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-237-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-79-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2488-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2832-61-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-31-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-78-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-17-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2832-236-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-68-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-16-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-56-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-282-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-54-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2832-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB