Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 04:06
General
-
Target
3fc6a8a2b3788af6e4ccfd400f94fa80N.exe
-
Size
29KB
-
MD5
3fc6a8a2b3788af6e4ccfd400f94fa80
-
SHA1
60ded98c713299f5a38b4265d993e743f706ebb9
-
SHA256
338303b639584e2eee6597fb47b9f726089afaf6283e63cca6dadd67c50feb11
-
SHA512
bf99505897928e282b47ab0ea19cd04ddc051918d51feb1a538c75a0268263b0cc60a84722df5ba1666f4f5cf06978ff28a0ec749c15ce36c4b068f61b7926de
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/XJ:AEwVs+0jNDY1qi/qvJ
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc6a8a2b3788af6e4ccfd400f94fa80N.exe"C:\Users\Admin\AppData\Local\Temp\3fc6a8a2b3788af6e4ccfd400f94fa80N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5e5c2364375c0a8a786a9508a840b6299
SHA1bec1874db0d2348274b6656d1383e262f73e2bc6
SHA25651b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3
SHA512ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD54e290b403028a214eecbc2661cd03b6d
SHA1a7a60214e0c46b09fd0e23ef7121511e790070a5
SHA256639b8e05abdca720e5d83cbef79b446113601a86cd0567502960061d6a9c95b8
SHA512467ab0848ce05d41d18d5ea79bb0f86bda677499bc0146f847dcc2c094f12ab67b59939f0233144fae98e2fb9dd11ab5086ed9ac4c3839aa56eb9be4c5e75f9e
-
Filesize
352B
MD508ffbd13de3a30f0e80a1d818f212da4
SHA1da6539a26b92384cd2dc61d10e83757dffe23266
SHA256c964ac2a09643ba8fce7b4173dd02bd1430865b633993c538c6aa215ff514607
SHA5125b5ff960e14040ee1a26cf78f4d919993fb07e4ba89b4b2a39c07adb6a0e8035f40ba9b356423841f08558b890e693b7c2d14a2a4eb44e894bd0586e31918efe
-
Filesize
352B
MD5e47973e40a104c36816b1484e0c0cb47
SHA1c6a28602f3e502d0541312a5f86588e9351d625f
SHA256c24cf3c1ba09225c22db751f042984ca6c3202ef7e054b6cd1726bc25b425bf7
SHA51279d3b427703af86fae40f7b96bda481e344e04d2d8e4f2405fd178d5a37b4775b84104652705a82d5dfb1c04ebb10d9d219b686173774efba3eb6a4183c51d9a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB