Resubmissions
21-08-2024 19:30
240821-x76q3sweqg 1021-08-2024 17:42
240821-v92h2avgpj 1012-06-2024 16:01
240612-tgps4a1bqh 10Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-08-2024 19:30
General
-
Target
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe
-
Size
28KB
-
MD5
6cdec3ccff3c2a0c2602bc89443f865f
-
SHA1
cf7ac47ec2e5b261786c9c11d30a09050bf459be
-
SHA256
510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5
-
SHA512
c97f74a3486b1018c2413473a82ca9d1f777c05993c4b3da4adca0006165107c2ecd14251f77e3cfcd8ea3949f64332e35e43648426f750aad8eb597f87370bb
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNanRiEMnY:Dv8IRRdsxq1DjJcqfFRn4Y
Malware Config
Signatures
-
Detects MyDoom family 4 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe"C:\Users\Admin\AppData\Local\Temp\510827ce687ad00545a1726c25a00f65e7d685b7dcd857fc6f11a0392feee5c5.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD540633fa830540fd683a52f2841cb35c1
SHA1b35a6c7a4abe5d2e22cfaefdaa6418cb78f746f7
SHA2569f8673739bc885c653e3681841e3b8a7ee160c5590fcc5be44d0cfff4fcd4af3
SHA512dd4e14cf5dc8410f812c30c04b423a0f9414ce11dc9ca749211168c1122912345bbf2d1dbb038e1ce9db1912704ba1e56e08d2e1257ee94e7ef8261d440bb33f
-
Filesize
1KB
MD59b7cf40d19e321a1073a51ee4eee28ce
SHA15119e54475bedea087c3dbff6284ec9e30d8301e
SHA2568b11fa917cd975e29043d46a7095bb6052f2b92266603f7154d85a980e286dda
SHA512803aec05f8d3fd8d6168737b78c5c0de79f2b9ca03ac098d4d960170b846922742e25676f8bb747a3575d48c832120eac99c3eb33b0f4a4fa88879e4d9fcbca4
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB