Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 19:15

General

  • Target

    95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe

  • Size

    29KB

  • MD5

    7fb1580bf0de3e12fe4e5dd8a8214250

  • SHA1

    232f013e467bbf3f608670fd45118ea61b0c3877

  • SHA256

    95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24e

  • SHA512

    b19a0262be13bad79d9ccbbe6a6854326796551a1eb61e8718efe872972219748c82a6b7ca83f316885d360d8142d14d2a7729a832c985bfdf720be6f672bd07

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Em:AEwVs+0jNDY1qi/qL

Malware Config

Signatures

  • Detects MyDoom family 4 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe
    "C:\Users\Admin\AppData\Local\Temp\95566d14abb584b081934af78c48c4a5c8b5464e6d38b16bf36d6ccfe239b24eN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAZ6MGFU\search[1].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\tmpF69.tmp

    Filesize

    29KB

    MD5

    41edd7e8efa7f249f5a4b054b96edc00

    SHA1

    fe83d129353df70dba45272d9ad69cebff292e88

    SHA256

    ad2e756600c2c2b5d3e9a31e3a1fb867b66a3ced79fbbffadc8d97e595315686

    SHA512

    04fc852b5085fb08f01d8af4b8ccf3bd561cf33b704974dc8cfe5e761cc5ed62a95290e650fef4b393f6fec3a79ac14a0857b7214c227e95c514d2b1d496130c

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    66f3d7a0fb61b89f8bbaca99fb77fc3b

    SHA1

    f7709f8a507fc0e2bd140ab8f2dcdf64e643b0c6

    SHA256

    9a69bf52fd8714386455f42d92276a7222ea205330d5e63cc4aba07140d0191e

    SHA512

    dff4e72c2f450f80cb3e7feb1adeb2238d59b849072f002d9bf13c2794d0af28fe737b885c447545ee517fdceceac1dc1bb6ce352d48112854736e8644a1b37c

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    384B

    MD5

    b12e6e247e16d5d4cbc0089ff5875357

    SHA1

    b0fbee00366a1564e10a3a6f99a9f8e02ee6cc15

    SHA256

    35709a229356df3d0d3004f2bc6cd73f3d96335188208c28e4b69dae0e61c3f1

    SHA512

    b9ef3795e20313773088b5415d065470eee5dd0739541d61cadb2811526088cb4713ba64b9fe05665cae471cd9c03ad09ae4ef275740f1aacc5f25a4f6921ba3

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2108-49-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2108-168-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2108-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2108-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2108-122-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2780-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-50-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-123-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-7-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2780-169-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB