Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 04:57

General

  • Target

    3078fbb39a1516f9ed64250f1ae7c35b90464419ced3084a947793297fc85db9N.exe

  • Size

    29KB

  • MD5

    da8357645076a4a41cabc738c30f81a0

  • SHA1

    dc681e8993430835557fa639300b049e26c6b281

  • SHA256

    3078fbb39a1516f9ed64250f1ae7c35b90464419ced3084a947793297fc85db9

  • SHA512

    234291f03054d19682e0a7c718447663dae46fcfa9ca52686ec828986eb1f346337c3ee085dd7b9bba2fb3935b1ea39211351a096d47fd726ae8e4185b39df31

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/k:AEwVs+0jNDY1qi/q8

Malware Config

Signatures

  • Detects MyDoom family 7 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3078fbb39a1516f9ed64250f1ae7c35b90464419ced3084a947793297fc85db9N.exe
    "C:\Users\Admin\AppData\Local\Temp\3078fbb39a1516f9ed64250f1ae7c35b90464419ced3084a947793297fc85db9N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp11FD.tmp

    Filesize

    29KB

    MD5

    9653d44aad8e1d9d07476aed9024a1d8

    SHA1

    deb1e93e0a7ce1d6b180746827ed442f5f01de80

    SHA256

    c537276669f7d5f448300f81d32f02a4d779c4766f59b5a37d10ab92e8dbe9a7

    SHA512

    1ec64d03089d53eaddfe70316100ef34f4567cae0595f95e450a5d2a07cd4615e24808f62e4465982219d793de075c4070e90b6d0b85c7dde5ef06258284e904

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    908052e8b9807181709bd23dc90bd0d3

    SHA1

    bd85df9ab974ec79381bcebe7e4d0fdec489c20c

    SHA256

    d1d0f4050a91b9db0da177bcd8f24d09a35e05cc7bbcc8237d0b86be391d19bf

    SHA512

    83d2da45d55178c7a2dd4121ff34ed4de95054b82c1e987cf16e10c4082803220a1fe01a75153cabddf6728deaebc4fb589baf3d17ffdf71baa199c9d3c82151

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2108-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-72-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-66-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2108-77-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2956-17-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB

  • memory/2956-65-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-41-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-69-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-2-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-71-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-16-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2956-4-0x0000000000220000-0x0000000000228000-memory.dmp

    Filesize

    32KB