Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
21/03/2025, 20:26
General
-
Target
8721842c26e2bfc31383e58235a7919c51d3f2fcdfa267d9f4c7a616bccf59a2.exe
-
Size
28KB
-
MD5
c3bee081437773b258f19be7af5309a2
-
SHA1
8994d85fbbf9dee441a1edd9db4b077ffc2f55af
-
SHA256
8721842c26e2bfc31383e58235a7919c51d3f2fcdfa267d9f4c7a616bccf59a2
-
SHA512
bbc302d4bd8ba9822ae082fced3ca2a3df523be1fa023f115f058276cdec713a06243b3d786dd6ede50c132674a3ea79d1933e9f195a3d33d4e1b53629a77c10
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNTd:Dv8IRRdsxq1DjJcqf+
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8721842c26e2bfc31383e58235a7919c51d3f2fcdfa267d9f4c7a616bccf59a2.exe"C:\Users\Admin\AppData\Local\Temp\8721842c26e2bfc31383e58235a7919c51d3f2fcdfa267d9f4c7a616bccf59a2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
141KB
MD58bedbaabb15e49ce6754724d3e6310b5
SHA18932c47324d745a88316cabc982b290672bee174
SHA2563f9c2ae51f8f57cee35f0a7848a2ea792eccc1fe8e39b3510fa7fe7efdef1fc8
SHA5122d93669b14b504ea4ac39f961a658607e5670ba4b09e6af34cb559e85f18cf23f0b13eb2110e868ef8baf8f9f46f74ca72401bf698b4a465dc669e667e3cd5bc
-
Filesize
153KB
MD5a3ac17e77dc3f84b4365f449371629ee
SHA1dd652128c224ed610cb06086d70de670ebe24a13
SHA2562b71d4c2e8c9ab0677a0df066c2d82760ba62b48e0af16ceffc8fc0026a7ac6a
SHA512506e27a5e2fe8e31bb4955f12c2eaed1fcfc1b02508aef3cbb4ac64fbccd2d2ac54613a9f4ed3c8a7c5f46e321b033272ac310dae2e0e70f4382d84bf731f2bd
-
Filesize
1KB
MD5a72a65310b566403d535ac8566ab7735
SHA1e1500669de28b5f155fcb35dbc2e725cb831635a
SHA2566b5519e699e9812c591f8e28702f46777e6f3617dffffe9d3552970abe656480
SHA51283eb7c9feca0c5b71dc01dd1a06e949ee6b17c7c547d8926440681b23f2fef22bcc5f8138a99abd3a19bef007e032f15b8b8014189b8d36cd824042b5976c7e4
-
Filesize
28KB
MD5dcff9d04cd403f6a3b64019d166309a7
SHA1b77504942877512119dce532d13ad78a09ef47a7
SHA25630e86bfdc2a3e100ffe687db28fd1ad6c3d6a37ad7a5194f9ce7f59fcd9888fc
SHA512f15c25f4b5b5508d392593eaa71a4d6d4d0f86444952391708503c4a888a17f95e1ce2723610e61a4cbf4c08185c0c872b02359bcab87d0836962857b2e5adc2
-
Filesize
1KB
MD536be0294561f523c00c94892e4de3700
SHA1e6a968b3decca302c5c78053fa65d57668225bc5
SHA25666ba7c8e40c9b69f435d8bca7f133958e71b0d34bda975f5e51a94a490f3baf5
SHA51252b304f1dc2a730fc8726ba3d9127bdbc8de2efe81121d7d8856e9892c8276c70dd6139e3be53f671a748cc1d16f8dbe7bbfc3f994cf39d17d26282b10a65ee0
-
Filesize
1KB
MD590892354060f44e2570738db1b7d5158
SHA18f619dd4657992f8f052f0b1dfcd59c3c0cb6754
SHA2569273160aaf53a133f5d5dc7887e1a9f97a6fe50b2f78aa3b3722410c54648e3d
SHA512eb591c6911a12108dc996685073712950e8da38a0b2fdf3f9beca3abae30e0a01f31aad847b17f74cfff9ab59b25b170165548bd2419fd238fff580a7a8043b8
-
Filesize
1KB
MD5d94dccc989d9d54d4c2e9d6388eab8bb
SHA1d5d316fee96b3e52a2d957165947b9135a8ee547
SHA2564fbe03c398080622cb5fbbc32bf15927f10650e6197014e563fd2a4c636a5e75
SHA5129d0ee5c7b2b480ea28f56b764baefb328c0385371f3a15c58e08774cbaa65aceb60b323f53e7c0c02ea43c70f25237a17ffd43d77858669251e3ab76d594766d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB