Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2024, 13:35
Behavioral task
behavioral1
Sample
7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe
Resource
win10v2004-20241007-en
General
-
Target
7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe
-
Size
41KB
-
MD5
a37325c7d9a198b82dc3c90fba9af6a0
-
SHA1
59a4bce32b523d797181013aa3dca5ad622547d1
-
SHA256
7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06d
-
SHA512
090bf43ec9eece66a51e10d4fe63e9c9e37d101986122cd14a7481a76fc74a16e2f34ff1df99c6ac72f8e277f509811cc97bbfe5fdff8a62b88fa9abc7b6f243
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
resource yara_rule behavioral2/memory/4320-13-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-44-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-126-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-162-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-166-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-171-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-186-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom behavioral2/memory/4320-220-0x0000000000500000-0x0000000000510200-memory.dmp family_mydoom -
Executes dropped EXE 1 IoCs
pid Process 956 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral2/memory/4320-0-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/files/0x000a000000023b84-4.dat upx behavioral2/memory/956-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-13-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-15-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-16-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-33-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/956-40-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-44-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-45-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x000b000000023bbd-55.dat upx behavioral2/memory/4320-126-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-127-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-162-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-163-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-166-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-167-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-171-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-172-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-186-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-187-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4320-220-0x0000000000500000-0x0000000000510200-memory.dmp upx behavioral2/memory/956-221-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe File opened for modification C:\Windows\java.exe 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe File created C:\Windows\java.exe 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4320 wrote to memory of 956 4320 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe 86 PID 4320 wrote to memory of 956 4320 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe 86 PID 4320 wrote to memory of 956 4320 7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe"C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304B
MD5cde2c6ec81201bdd39579745c69d502f
SHA1e025748a7d4361b2803140ed0f0abda1797f5388
SHA256a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
SHA512de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4
-
Filesize
305B
MD5157431349a057954f4227efc1383ecad
SHA169ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA2568553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA5126405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
41KB
MD53015832dc61e0adc83e4516ba7d43030
SHA14c688e26d7f65e0091e81ccd0cc8265d4157126a
SHA2565aebd6b8354e2ce391047d8a31857441b1463e83958b186b670800bb9087de81
SHA5120c4db84e6e8fe60d02a4a7ebb79b2593f65256d834a42a9d3961ecd52f4ab0ca5af727d5458268d88d412c595a880750da0f16ca64d15c4cc6f8ed35714ecb5b
-
Filesize
192B
MD5c9ecf6d737ee0d2fdeaa883261b12ad0
SHA11147363718c5414bcb815603d59644bb3a596525
SHA256ff0c7e4342a5d06fab9ec92fbef18f0c1760c0521876486558602d7a9a44b4de
SHA512d69ba88cdb61f95ce491df23094731a98d82a2616771a336cc5065553948c84b46e514d1c6f1c1d20407270c09e3d76dcccdfba15ce7e8a1cb6d04792c561941
-
Filesize
192B
MD5056e99ec662ebef49c92d89b1a8d1699
SHA1708ddd9a3aeaf9ca3f44f2b3bf84905520c8cbb8
SHA256aaee165d8b44b0fe06b802a9219ea10806751b771a1cf084442edb5e24fb3128
SHA5121bdd99a70ac9fa7325bb44b9662aa7e904412a3a949d308e2ce1497c16cb2673b1566fe5ce09fcb2fa82125867172efea4f1315b5330fe8a97d06d07d7a01469
-
Filesize
192B
MD510eb584a1cb1c9d0df0011eb65057a30
SHA14e6beb853ef675d9d2ac5cb5d5c03cbbed7384d8
SHA256cb371f43d8f04c4c779e04df0ea0702433fa726c2719c4348f29f4658dd29b7a
SHA512e178a6a8578dccc8a1ef6daad35da706b291250ce9789123de7f89193ed71da4f9b61d0dfe31e40b2edaf5e6ab37dfd633e9ebde20f36d07e8d26bcfc6ca626f
-
Filesize
12KB
MD5b9f93a54122b0a908d2ba0b922993dfd
SHA1cd4f00ca2ab21eba5fb852df2121513e97f5a802
SHA256237bc5b7a2aa0503846645c634248d765046f8b8db17d3950d0e90cab729d7f1
SHA512b56596cb0e569086bbd7b81067ced7077f13b54a0b94521034ee3432c96189b5b74aa5021129199b0277cdec757cdd6cc40d54299ba4bd4151f63afc6e5620ca
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2