8f78806e212e18346b63aebddef9d4ffdc15e12d6c6485b73353989f382acb88

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W32.Mydoom.htm
Size

39KB
MD5

10a5ce311f8f925a5d180d01aa62b560
SHA1

3b9eae541c1bda796a8a29671671d666a32d68f5
SHA256

666c6ad2b3bdeac9c0d42a263631958b3e2e77b197859559b90b5a193b3c81ca
SHA512

e322dc16f5b2b689102ab55c2a7c8eaed00d4c514d44c3445b91d1a60fd5be2edaf753396932d3b27d020e054a822fb704454e86c107a9e6e81e82b183c477b8
SSDEEP

768:/DS7/t18rlh0iofFsJUxcuhupvjMktozccKc:/DS7/t18rkio9sJUxc6AcKc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200aef1353eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DD55381-5A46-11EF-B8BF-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000011663741ff8ef45402609416acd8bfe24b60ec2fb7894803915b207798eaf982000000000e8000000002000020000000c97b213a4e47f6742549e349d0b97bc7c76f747a042ec7a510da3fa25f86d70a200000004e3fc383ee2c7aab5fbdeaff6b3091012ea9d6d558b4ec6da5313da06b93eece40000000db5f9a04d7c429450c5fa0c10767b6e5ea02633de688d8c3fe5e577514e4b73c4b22e85ec05f5efcd342ed1d7eac5a7517bf22134d594cb2a699b87dadc140f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429806190"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000df6624b20e5134094d68f0d2d0a589825386c940941e37a1e5855e2973bdb8a2000000000e800000000200002000000009f74539e8cbf3d1759695ae1ac33c1ac01b5394942615387a6f6dae6c020a0890000000ced26ab4a591d7122589d920c0dbe14d3cd67c689e7b1d2eafdc5810c08f25dba150c1ea26f1ab339048645bcd4f5701ecc70c5ffc40a529aac0e10ee0f48808a00e967f09fa9e6eeb481767286d926f0cc640e5b8d8d11f2ba6e05eb621fc44bab8a7d2759083ff01904a50c3735df7d73b9a6097ae4120458cf5a448439298341a8c0279591028eab288f90fde89e0400000002d1e95cef482f21386939e707c6b596487f9c32fb1eea420da5a68566d99aa3035375df8262a975525ccae85caac6f51520caade8bdc3b8deeefc27dac204509	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2964 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2964 iexplore.exe
2964 iexplore.exe
1452 IEXPLORE.EXE
1452 IEXPLORE.EXE
1452 IEXPLORE.EXE
1452 IEXPLORE.EXE

pid	process
2964	iexplore.exe

pid	process
2964	iexplore.exe
2964	iexplore.exe
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2964 wrote to memory of 1452	2964	iexplore.exe	IEXPLORE.EXE
PID 2964 wrote to memory of 1452	2964	iexplore.exe	IEXPLORE.EXE
PID 2964 wrote to memory of 1452	2964	iexplore.exe	IEXPLORE.EXE
PID 2964 wrote to memory of 1452	2964	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\W32.Mydoom.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a66a655f08c59718814031f7209fa3

SHA1
ba57e2ca5d1844a4f0451969a82de6db5302784d

SHA256
1013c2a12a53ce21ac63a9cae3cab9ef982f2ca9d15338600b8fcdcb77b71612

SHA512
71312c17b2a03eabcb96f09083ff45916959a68217d11020f316f212587b7ab768608842023f89702dd26cc26ea39befde1a70b05403a425f8b5d791490d0f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d73e6ed18189df29eadb3409a29e456

SHA1
4ef88555e913d256a0cf7f34101bd5719087e362

SHA256
413a3045a0f790227d412aab9310c1ba388030ecdf2f916596f4ba22257d439a

SHA512
5b97d723571813b88a466547e153d7f8b74eb7faf0ff80aecf8d9f00af548436d7004ed5cee298d54a350c8eb35b994123ccd01261d064e3ef2c1674861f4aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c4a0466c0370e8de13901dc82cbac3

SHA1
e73230cb82c61a92951b4d6275dc2438274fb078

SHA256
d07423e14271a178c7036e32fad84a6f5afda65a3fe8837d8822b5e948aa0c7f

SHA512
899d1d34b10b5417301430cc4abe6c75c15682ff19391e3540b267600a0705157cc9103e3eb6b519a3744858c65778211abdda337b1a42b4f7a4df9ec0ac40ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07b1213cb7c882acc45e1148b05769c7

SHA1
a5a635b48313c52fb1dd26ddcea502f79be5d324

SHA256
ce287af09d7a78325b4976bc3449b9495640cfeb2f5d1649ec248ac782f7ee32

SHA512
9d957b0856e7ed40b9ec9d7e0f60c48a5b6d691381c93a87dd53eb0382c9639b89cfffc7c171545a2a392dc588f3a40e6520af1b68b0b47092055a07b578f324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a3a1152cdba3a1c7eab723397d0cab

SHA1
ce2a9700b5927e8d1238c85d111193ac5da09a5e

SHA256
eb957b23d1f81d44130327b763df8e5f32e6bc3648cd04192c19bf09b14ebb82

SHA512
3686dd35e5cab814b1893c519cf138ffca95b5f9fdf1f8f0e7ea5f8c56958f598419273c0386d368dd8abb46c94a2da4a38bc95d01291486ec683acbdd66d9d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae94c7e40ad59b934f0582ed2097a5fa

SHA1
71518ca6920e0171f590697b5607dc01b1128159

SHA256
3e10c9e5115e3d5b511294ac53409252dae6a57b1be271b49b4b7ca580dece32

SHA512
6c926f63366b6aad42cd4e45809c87d0c46fb5bfc0809fe28217f51a0f1d1869195d0e537dc1cbda10b73df3f35a20e1e1e610861964faeab8d25a39ba878e4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b364449f00c753af4737717f06f6c6f

SHA1
85be6450e71459a935b97ea67529e0cd6f6f3b65

SHA256
bb35586c121714cde2321caa2b2ce2e9fad23db477de436bb6e97eca9f8754fd

SHA512
082d75d86627255c7f6d3d97f518fe38fa8fcd229ec61d32123a356a6f4c862120daccdb7b3d9324e8fd9545f217eac9640efc39fd8793796702a06d290e9ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
628439a43f43b9c84032dff7b52aa7fb

SHA1
63df586865060e8cbe2777cce6a54dab08dc8d8e

SHA256
3d8caeb2c5f5e57cf5ec6aed5865d1117facfe1fab79c26f936968461a2bc2a6

SHA512
9076c615e623c96ec22fe6e9a19ec413fb07f43f369b93a13868c2d9e96d909cfe86e08a664b03b6f77a1ef5c6650bb1db3bc0588da1565c5bce023113839d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1af86c9ffb52f3ca7745cb1abe8a0d97

SHA1
53345fe56ec94681f43571d6d410a9da9795fe0c

SHA256
4e87694efb04590a0fd2fc49a7611bf8be814ee0fb54dea8ac17f1826b132aee

SHA512
d442d227057defd325e90401a288e8235b18f3a647c11a45b70876380e06b059f0e350bb19348f495657b6e26618117d5743650d88c5d2f9e84ed1fac385be75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2949941974c09aab899e286f71d8f895

SHA1
fe542e43df4b7a6d78e042b3d3ec94032c0c558d

SHA256
2b30eb2afdf4d4abea1cc17c25449f50ff35eaa7baacbb1736b4531f0af7827a

SHA512
64b5a7acee8bf2fda76d828bd381d0cb3c1231ea0cdb5cfb88a6fe8fd11ef89e74a310f901a8c57692911a90127048b90337636befa01a09880502ec12354702

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6013dfba6b3dbc1f151685adeaae7890

SHA1
ffcad41e1808d66d3c41a9958b769f72074ee8f5

SHA256
56619765d4bcead93353f0f9b6b0b699cdb2a323bfe163fe823c589ba6a5dde3

SHA512
5249b20abfb4d87ee9de5f9ee5df7b29ca5175c0a2360c932517aae56cf183cad04291bbd1a0c3d1db87e66a39565ac848a004e05b30da1517bba591a35f09de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec2a57754884e1b8be55c01405b755f0

SHA1
76c4293a623cdb512a589904f0d6c298b055258a

SHA256
282955fa12163d464062aa8e85b78dedf250ab33954995ab7af1ee9630142885

SHA512
dc29377d574203c7b8cafba21568bc9479fbccb22966ee1ba4b683e09d29f53d0cf67c16a54531028ffbc9c8bd3154c9661b74de66bc5f4eccf085537db628c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e89b7a277a5a6b7d09eaa157526aa0

SHA1
2820d6be6cd99597b662a9af66d7ff55c7f4ff17

SHA256
f178a82c8b87bc4126b739873e6fd1ebdde795b26741b54c5b0c6e7f545a2f7d

SHA512
f919fa98e50f3db2bbbd28102564e151b9dc31163912b66f8c238a7246a647be3b1a94bde5469c165e3751e2131a9a4f90f0155569546f2b18eb9f38d4278ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa54478d97e2cf47f96002746682634f

SHA1
f98174534b26381575819043d3fa2a53708c2185

SHA256
d9886a377b910e2cb948499e1bb0025c1673f589cd1e8cc559bdc1c8c9314535

SHA512
09c69418adb6e9cdf4861db71f02b3e0f98dceaf73ecbdfba25e2936c6e757ffd2117577bc2cbd52acac9593c28f90aaabf274245d8591ccb1047dfd02487961

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6BB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC76A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit