Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2024, 13:35

General

  • Target

    7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe

  • Size

    41KB

  • MD5

    a37325c7d9a198b82dc3c90fba9af6a0

  • SHA1

    59a4bce32b523d797181013aa3dca5ad622547d1

  • SHA256

    7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06d

  • SHA512

    090bf43ec9eece66a51e10d4fe63e9c9e37d101986122cd14a7481a76fc74a16e2f34ff1df99c6ac72f8e277f509811cc97bbfe5fdff8a62b88fa9abc7b6f243

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q

Malware Config

Signatures

  • Detects MyDoom family 8 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe
    "C:\Users\Admin\AppData\Local\Temp\7c289fe48d3a4448db823919b0a773ecdba9592b8a9b74348f2612119daaf06dN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\default[2].htm

    Filesize

    304B

    MD5

    cde2c6ec81201bdd39579745c69d502f

    SHA1

    e025748a7d4361b2803140ed0f0abda1797f5388

    SHA256

    a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

    SHA512

    de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\default[4].htm

    Filesize

    305B

    MD5

    157431349a057954f4227efc1383ecad

    SHA1

    69ccc939e6b36aa1fabb96ad999540a5ab118c48

    SHA256

    8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

    SHA512

    6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\search[1].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\default[3].htm

    Filesize

    312B

    MD5

    c15952329e9cd008b41f979b6c76b9a2

    SHA1

    53c58cc742b5a0273df8d01ba2779a979c1ff967

    SHA256

    5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

    SHA512

    6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

  • C:\Users\Admin\AppData\Local\Temp\tmp1229.tmp

    Filesize

    41KB

    MD5

    3015832dc61e0adc83e4516ba7d43030

    SHA1

    4c688e26d7f65e0091e81ccd0cc8265d4157126a

    SHA256

    5aebd6b8354e2ce391047d8a31857441b1463e83958b186b670800bb9087de81

    SHA512

    0c4db84e6e8fe60d02a4a7ebb79b2593f65256d834a42a9d3961ecd52f4ab0ca5af727d5458268d88d412c595a880750da0f16ca64d15c4cc6f8ed35714ecb5b

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    192B

    MD5

    c9ecf6d737ee0d2fdeaa883261b12ad0

    SHA1

    1147363718c5414bcb815603d59644bb3a596525

    SHA256

    ff0c7e4342a5d06fab9ec92fbef18f0c1760c0521876486558602d7a9a44b4de

    SHA512

    d69ba88cdb61f95ce491df23094731a98d82a2616771a336cc5065553948c84b46e514d1c6f1c1d20407270c09e3d76dcccdfba15ce7e8a1cb6d04792c561941

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    192B

    MD5

    056e99ec662ebef49c92d89b1a8d1699

    SHA1

    708ddd9a3aeaf9ca3f44f2b3bf84905520c8cbb8

    SHA256

    aaee165d8b44b0fe06b802a9219ea10806751b771a1cf084442edb5e24fb3128

    SHA512

    1bdd99a70ac9fa7325bb44b9662aa7e904412a3a949d308e2ce1497c16cb2673b1566fe5ce09fcb2fa82125867172efea4f1315b5330fe8a97d06d07d7a01469

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    192B

    MD5

    10eb584a1cb1c9d0df0011eb65057a30

    SHA1

    4e6beb853ef675d9d2ac5cb5d5c03cbbed7384d8

    SHA256

    cb371f43d8f04c4c779e04df0ea0702433fa726c2719c4348f29f4658dd29b7a

    SHA512

    e178a6a8578dccc8a1ef6daad35da706b291250ce9789123de7f89193ed71da4f9b61d0dfe31e40b2edaf5e6ab37dfd633e9ebde20f36d07e8d26bcfc6ca626f

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    12KB

    MD5

    b9f93a54122b0a908d2ba0b922993dfd

    SHA1

    cd4f00ca2ab21eba5fb852df2121513e97f5a802

    SHA256

    237bc5b7a2aa0503846645c634248d765046f8b8db17d3950d0e90cab729d7f1

    SHA512

    b56596cb0e569086bbd7b81067ced7077f13b54a0b94521034ee3432c96189b5b74aa5021129199b0277cdec757cdd6cc40d54299ba4bd4151f63afc6e5620ca

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/956-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-172-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-127-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-221-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-163-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-187-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-167-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/956-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/4320-126-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-171-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-186-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-166-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-162-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-220-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/4320-44-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB