a548c105eca13369ca3f09b781442ddfebe64ec19d7402bdbf35a8b4d944d7f6 | Triage

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-04-2022 15:47

Sharing

Report Analysis Logs

General

Target

Email-Worm.Win32.MyDoom.exe
Size

22KB
MD5

53df39092394741514bc050f3d6a06a9
SHA1

f91a4d7ac276b8e8b7ae41c22587c89a39ddcea5
SHA256

fff0ccf5feaf5d46b295f770ad398b6d572909b00e2b8bcd1b1c286c70cd9151
SHA512

9792017109cf6ffc783e67be2a4361aa2c0792a359718434fec53e83feed6a9a2f0f331e9951f798e7fb89421fdc1ac0e083527c3d3b6dd71b7fdd90836023a0

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Windows\SysWOW64\shimgapi.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
\Windows\SysWOW64\shimgapi.dll	upx

Loads dropped DLL 1 IoCs

Processes:

Email-Worm.Win32.MyDoom.exe

pid process

1276 Email-Worm.Win32.MyDoom.exe
Drops file in System32 directory 1 IoCs

Processes:

Email-Worm.Win32.MyDoom.exe

description ioc process

File created C:\Windows\SysWOW64\shimgapi.dll Email-Worm.Win32.MyDoom.exe

C:\Users\Admin\AppData\Local\Temp\Email-Worm.Win32.MyDoom.exe
"C:\Users\Admin\AppData\Local\Temp\Email-Worm.Win32.MyDoom.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:1276

C:\Windows\SysWOW64\notepad.exe
notepad C:\Users\Admin\AppData\Local\Temp\Message
2⤵
PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\shimgapi.dll

Filesize
4KB

MD5
8750df7c3d110ebc870f7afe319426e6

SHA1
a770fff05a829f666517a5f42e44785d6f0b4ae7

SHA256
fa3f934083746a702de18b927284f0145d4b82a92f2111693e93a4f762b50c00

SHA512
dfcbc2ba358ec40143e842d5242781a59943e646f50c41010a8cc4e2c5a15d5b19dcd2ee9556a0317ca73283e84d1f9d1b0b8b7470b493fe38e4e027336b8a2a

Download Submit