Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/11/2024, 10:10
General
-
Target
e6de71a327dbff8a8ce3111c58bc7dd7290f9188d354995350f0c1d70d009875.exe
-
Size
29KB
-
MD5
cebb1d721f18689e003a7b6e2d61dad4
-
SHA1
8075d3e5d32e84c3bfc4cf8f49979ff6d570f2e0
-
SHA256
e6de71a327dbff8a8ce3111c58bc7dd7290f9188d354995350f0c1d70d009875
-
SHA512
e3f53cbf32a4abd1e210544c482c0de56b24d5e28cdae2fae15760c6efd27c10a9ebca6993fb42bff641581790d8d74a97751927fa0adc1f28dad7d81674a442
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/vI:AEwVs+0jNDY1qi/qI
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6de71a327dbff8a8ce3111c58bc7dd7290f9188d354995350f0c1d70d009875.exe"C:\Users\Admin\AppData\Local\Temp\e6de71a327dbff8a8ce3111c58bc7dd7290f9188d354995350f0c1d70d009875.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD519d2e150702589d410001043b14f82d9
SHA12c84c43a32148ca27c7b85e8ccfc7ab54b1320eb
SHA2560700aa62d135ca05d98f396196fb998b1d9f1f0c1cfaf4cfee2bd4f963734a34
SHA512241901d9a8cb30bbfc4adbda798666e1a09a85098060785ac660f4674f40504c18b4d03606dd229f93db68d6350532c834a77730dcccd4a95849d8a763b6e772
-
Filesize
352B
MD5a66093eeb339c44c6ba9e287c7b0d2c8
SHA1546de31e07acd9b379914b0511a09a66603a5e04
SHA2560e24f4dc1719034c15490df76118001ca83ec1b5f8df2f0011316bfa3ffd6e3a
SHA51291d34999f66c92bfcf75ba8a2893fdb30bc8c8786225c18eba990609573a832c949c0dcfda19d8407e40f1eb1f93f4d25afb8fecc1322fd410f83a9550dc1081
-
Filesize
352B
MD57a7ef4a31fbe3b38298b8cfccacc2de5
SHA1c6d8caed4729f4dd419769dfc22bf72498d5a202
SHA256b64f1bb8ac68fd0f1f0ac5c4f773bbe8a61aae004c31a5427d8f8f8821998bc3
SHA512d369583109b1b72b2be35872c821edd63490a6af43d373ea543a8572b7d2ded4c4c219af51ea995e4c840bd57c80cb2c096c949085daa94fcdfd95b7795cade7
-
Filesize
352B
MD57999dbdb32e46448c3430917e7667e51
SHA1aaa4603204028d46cde61549207669ca4bc2995d
SHA2561b1aba9c20f8e3d8ce35469b883905ab5933116b50ab2a1758b83c9d017fdf6e
SHA512cda313bd59e7480027a3713681f67ced7ac725e14113c59737f8858b5524f3cb094aac64c705655d4520d6ce12dfbcc815c27636aefe6367c9ea0f13d6354605
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB