Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/01/2025, 16:21
General
-
Target
83d4e219b38b771ff9d2a4d218314c80c1eca662d4e707520e2d88706a5702bc.exe
-
Size
29KB
-
MD5
e160eb6b7aa3ce796fac0b75e3c317a3
-
SHA1
01c189e1869585dad9fc0b455b65ad1da707faa7
-
SHA256
83d4e219b38b771ff9d2a4d218314c80c1eca662d4e707520e2d88706a5702bc
-
SHA512
7af75e53ab684cdef393091f1f481211fbcacc4df4e8a1f2ade88368c48ee6a2823e068f74e0eb14d3fef05394cb58daca61074d73f08b3e4617d2116fea58bd
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/phQ:AEwVs+0jNDY1qi/qRG
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\83d4e219b38b771ff9d2a4d218314c80c1eca662d4e707520e2d88706a5702bc.exe"C:\Users\Admin\AppData\Local\Temp\83d4e219b38b771ff9d2a4d218314c80c1eca662d4e707520e2d88706a5702bc.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5e160eb6b7aa3ce796fac0b75e3c317a3
SHA101c189e1869585dad9fc0b455b65ad1da707faa7
SHA25683d4e219b38b771ff9d2a4d218314c80c1eca662d4e707520e2d88706a5702bc
SHA5127af75e53ab684cdef393091f1f481211fbcacc4df4e8a1f2ade88368c48ee6a2823e068f74e0eb14d3fef05394cb58daca61074d73f08b3e4617d2116fea58bd
-
Filesize
320B
MD5097be3fb93dc3ab80fb0dc711a61c598
SHA1cf5f0c994d8f0f38c0d04dbc189ef0e43b1eac87
SHA25612ccb9b844b5be6e7a595abd40ee05c7729084937d0de583201c13c0d6511418
SHA51201a1c48955d07f3eb8582ed8ed1e8a91f617410ffca958cbdf569135b40bba7e1b996affc742154e78ff08e2039bc875399d026db503fc366975725e31226ebf
-
Filesize
320B
MD5e6a73242e5a5968ce1dab29c781cf84d
SHA1121f2bb4e6bbb5021bd78e0765382a1f5fb7bb1c
SHA25612d022082a5a05fc3710b39c27a155efc9f0494b3d33064096d4cbf0dd3e51cb
SHA512f538e574bf9cbab23ad018b5b6f437b9fa34ffa57e660586b9cfd1f3a5f20296b268af28b489e7e1fd49c88f75410abbb23b3ec76b72e61c8367c2389e95d012
-
Filesize
320B
MD516bd8734528572d94d021e4f2b246879
SHA179e3b09285f3f0171290ffe2db08ddc568b52067
SHA25674456ca2662450f84775f6d249991f1d4425d133ae52a6cc1124c37800f71519
SHA512bd7c85046f3a8ecfb3faeebe9ad84954b681d4d0e7f38c4eb89f07b78124eeb4989828f2c574cc6e2946c63356765e721463afe8b58c725a9c2b81cae0e29818
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB