Overview
overview
3Static
static
1MHDDoS-main.zip
windows10-2004-x64
1MHDDoS-mai...rt.yml
windows10-2004-x64
3MHDDoS-mai...ig.yml
windows10-2004-x64
3MHDDoS-mai...st.yml
windows10-2004-x64
3MHDDoS-mai...ot.yml
windows10-2004-x64
3MHDDoS-mai...is.yml
windows10-2004-x64
3MHDDoS-mai...ge.yml
windows10-2004-x64
3MHDDoS-mai...ignore
windows10-2004-x64
3MHDDoS-mai...erfile
windows10-2004-x64
1MHDDoS-main/LICENSE
windows10-2004-x64
1MHDDoS-main/README.md
windows10-2004-x64
3MHDDoS-mai...g.json
windows10-2004-x64
3MHDDoS-mai...tp.txt
windows10-2004-x64
1MHDDoS-mai...rs.txt
windows10-2004-x64
1MHDDoS-mai...nt.txt
windows10-2004-x64
1MHDDoS-mai...ts.txt
windows10-2004-x64
1MHDDoS-main/start.py
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
MHDDoS-main.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
MHDDoS-main/.github/ISSUE_TEMPLATE/bug_report.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
MHDDoS-main/.github/ISSUE_TEMPLATE/config.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
MHDDoS-main/.github/ISSUE_TEMPLATE/feature_request.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
MHDDoS-main/.github/dependabot.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
MHDDoS-main/.github/workflows/codeql-analysis.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
MHDDoS-main/.github/workflows/docker-image.yml
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
MHDDoS-main/.gitignore
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
MHDDoS-main/Dockerfile
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
MHDDoS-main/LICENSE
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
MHDDoS-main/README.md
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
MHDDoS-main/config.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
MHDDoS-main/files/proxies/http.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
MHDDoS-main/files/referers.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
MHDDoS-main/files/useragent.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
MHDDoS-main/requirements.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
MHDDoS-main/start.py
Resource
win10v2004-20240802-en
General
-
Target
MHDDoS-main.zip
-
Size
44KB
-
MD5
a8d079f288a9324714624e5ba83bd4d6
-
SHA1
28f9f6b5867216b28f219f114154f2042e6f2115
-
SHA256
6e2b4f2c1cfb35a23a4b279d240649ea63e1220d1c81ecc705874b72152423de
-
SHA512
6beb4a6163e89f4123d6c8b8cc1f038f7a056b08e53b74f0b034a79cb98f3cde96d7179fc092a7568c4ece919ba87486147b9f91da82e1ff2bc7e70a65472087
-
SSDEEP
768:jwzbcYGZpnz0L05VFsNDXUWCvC9ZcnTGyeAgeJPMQJeEGwJW7nj2PCvBy+3rW1tA:czpGZ1z3AkPCMTGoNhMQwE1JI3rW1tjM
Malware Config
Signatures
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4868 OpenWith.exe 1968 OpenWith.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 4868 OpenWith.exe 1968 OpenWith.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MHDDoS-main.zip1⤵PID:4388
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3692
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4868
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1968