Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2024, 23:15

General

  • Target

    235f64949cb368a3fcfa6ab3254c266ec7b9cb80d9c556520179b454116922c6N.exe

  • Size

    29KB

  • MD5

    fe46a38fc6364fe6dbe73851b51aca00

  • SHA1

    21a54d8a8019aa99ceaeda5d54ec6beaa509879a

  • SHA256

    235f64949cb368a3fcfa6ab3254c266ec7b9cb80d9c556520179b454116922c6

  • SHA512

    9d7838be3382dde01799ef071aec49561073b64e7f009b962096d8f2a862df705f23f4e60e131211c06a32fa2622a1f150c5f202d4d1d0355971f384cb6a264c

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/7:AEwVs+0jNDY1qi/qT

Malware Config

Signatures

  • Detects MyDoom family 6 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\235f64949cb368a3fcfa6ab3254c266ec7b9cb80d9c556520179b454116922c6N.exe
    "C:\Users\Admin\AppData\Local\Temp\235f64949cb368a3fcfa6ab3254c266ec7b9cb80d9c556520179b454116922c6N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp761A.tmp

    Filesize

    29KB

    MD5

    039afdee0d3c55e9c1917d6e95c24c13

    SHA1

    9a608fa7432eba08375c636f20484fdae071db85

    SHA256

    2d06b5ac267af6c20b336452484c7ded667daff373b33c7e56a1d1e775f3a2f3

    SHA512

    0ea215af458f9d325d23207a83c5c0842ab6089522203a2d576a6b2c4d9176899aeab0b7fc0f6d8fe165b8418410075db9d86a50e018d5c969ffa9288c01dac5

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    8e7421b00c0ff32e314eb7841e16dfa0

    SHA1

    8e5a9040b1b7ae7d6e7dba3f89fc5209408c07d8

    SHA256

    ce096dbfe2fed64a43ac6131f1ac269df3317c815f6fc9d76d784e5b3ed0d943

    SHA512

    b38695b325bae51ca6a8cff726b6f302b8b280ab068b93273d91aa1bc2aefe548514927b30f91ea135482467533e62fb918790846fb34809eda5f567594b4b9b

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    9d67b2f056a6492df1a03aea522b5835

    SHA1

    b95044548b3097d77fbfdb3bc150f182b95012fc

    SHA256

    c0b8b0002fd3975d8f0ed13b75f12d0016010f7a24c98330adf3b1cb09341c95

    SHA512

    9d31e07bc99d722c0bbeb27cd13e2eadb13cb82d7eb40420af8bf1975317fc2bf1cdf96d1456fd704de1124f6df772a9ebbc00a4f79f8668cae34cf4cfb52e95

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/840-19-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/840-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-18-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/840-9-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/840-70-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-63-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-58-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-56-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-33-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/840-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/2540-34-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-39-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-57-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-27-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-59-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-22-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-64-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-69-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-71-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-76-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2540-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB