Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/01/2025, 19:15

General

  • Target

    95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe

  • Size

    29KB

  • MD5

    7fb1580bf0de3e12fe4e5dd8a8214250

  • SHA1

    232f013e467bbf3f608670fd45118ea61b0c3877

  • SHA256

    95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24e

  • SHA512

    b19a0262be13bad79d9ccbbe6a6854326796551a1eb61e8718efe872972219748c82a6b7ca83f316885d360d8142d14d2a7729a832c985bfdf720be6f672bd07

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Em:AEwVs+0jNDY1qi/qL

Malware Config

Signatures

  • Detects MyDoom family 5 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe
    "C:\Users\Admin\AppData\Local\Temp\95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp906F.tmp

    Filesize

    29KB

    MD5

    55f15472d0b27ab4d93de2e69e09655c

    SHA1

    5e988a3358127e75deec0a15b0f01e0c1f0856c3

    SHA256

    3084d995ad86697368c28fc5a3b53a88283e45ad6a3807ab03d345aefb2ab725

    SHA512

    7b2f5c4c3b793ad686dc7d964c71dbc7a7b23e5594f9592d85e3719a0a78e2cce9cd16cde14e6d96db2a83bafc9e627b1a309e4cd9da92a477141396c27089ba

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    22233019f82001d92c711401a3d43d27

    SHA1

    db71b7eb8e0c775539e17f39a9711f076952d229

    SHA256

    3820afb96fdaf484819845ab65c7470abfc055f58fad89f8d471b89dcd9ac82c

    SHA512

    3bd6663d03952ebfbd600277bf7c668f9d83c8949edcfcdeee945d79f19836d64944ed56ddb87c757b0d5511ec1d5d6cd2b507ccb61bc35534474f555374feef

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2732-2-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2732-4-0x00000000002B0000-0x00000000002B8000-memory.dmp

    Filesize

    32KB

  • memory/2732-9-0x00000000002B0000-0x00000000002B8000-memory.dmp

    Filesize

    32KB

  • memory/2732-77-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2732-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2732-53-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2872-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-42-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-44-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-49-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-54-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-56-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2872-78-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB