mydoom | ba01ab99a73b57c835d58c1eeb82b8c9e5e1d97b4896691a89e0d51c8a8cf168

General

Target

c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
Size

28KB
MD5

c093d066223bfd1d06449685064545e1
SHA1

95daf95f3250166e1e83f2e77b096cac2169ffe8
SHA256

ba01ab99a73b57c835d58c1eeb82b8c9e5e1d97b4896691a89e0d51c8a8cf168
SHA512

a6a0f7b997c9709136ad483df755569235b46c2c00ec33c567894bc463fe42c3e6de1b56abcffe18c1cab8e02c5cdcf3ebca97871523e19de6135663935e0fa7
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN57jA:Dv8IRRdsxq1DjJcqfMjA

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral1/memory/2960-16-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2960-55-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2960-78-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2960-80-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2960-85-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Executes dropped EXE 1 IoCs

pid	Process
2916	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2960-4-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/files/0x000900000001722f-7.dat	upx
behavioral1/memory/2916-10-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2960-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2916-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-49-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2960-55-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2916-56-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2916-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0015000000016d89-71.dat	upx
behavioral1/memory/2960-78-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2916-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2960-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2916-81-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2960-85-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2916-86-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
File created	C:\Windows\java.exe	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2916	2960	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2916	2960	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2916	2960	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe	30
PID 2960 wrote to memory of 2916	2960	c093d066223bfd1d06449685064545e1_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\c093d066223bfd1d06449685064545e1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c093d066223bfd1d06449685064545e1_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB849.tmp

Filesize
28KB

MD5
5bbda5973caea0024ae41b602cc57c5c

SHA1
0dd3b3a60cf69383198dbe0370b687333123ab73

SHA256
4c611a586a7e68fc0f64124a8945854183d27a94a48db3f53eb003b1793a1a2e

SHA512
eb7d18940d28feb2442f233dba6a4cf56d1a9112bc9925a15ce8fec0fc77277a20b019b426faf705359796aca1b0427aa34640bc945f3164f0db4c6a41f7bcad

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
50a4daf51a61101d12f3a3023ebaec0b

SHA1
a46254b0ecf822d4f7221019fd5871be23737f00

SHA256
b8a34767fd7a4c3137f0ddb7d7a09f57a305135ca8d47afa02d03d8261574781

SHA512
ff4e35a56264e154f35236216af76cd00abb68d06dcfb4a32533090b268095cafbe0e463226b1c67f8119fb9248b351446e6e284b7c5c82eaefab3769719590f

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2916-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-49-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-86-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-81-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-44-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2916-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2960-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/2960-78-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-85-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2960-17-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads