8f78806e212e18346b63aebddef9d4ffdc15e12d6c6485b73353989f382acb88

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

W32.Mydoom.htm
Size

39KB
MD5

10a5ce311f8f925a5d180d01aa62b560
SHA1

3b9eae541c1bda796a8a29671671d666a32d68f5
SHA256

666c6ad2b3bdeac9c0d42a263631958b3e2e77b197859559b90b5a193b3c81ca
SHA512

e322dc16f5b2b689102ab55c2a7c8eaed00d4c514d44c3445b91d1a60fd5be2edaf753396932d3b27d020e054a822fb704454e86c107a9e6e81e82b183c477b8
SSDEEP

768:/DS7/t18rlh0iofFsJUxcuhupvjMktozccKc:/DS7/t18rkio9sJUxc6AcKc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000005d92bb7e89ed2e102021915e247a68bd0291328ecd493cc1f89f8e72109e7c3000000000e8000000002000020000000030d8b91338205991e13360e2a8d9bff0a7731fdba583999d5018973885420c3200000000eeb933fdbc322809b444d91d4e3a6b90faae63736f185a66bb3c2d0fda1fb09400000006e190440591c798fe3563cf0b277416712cac6cfbf5ef9a039ab50611cc1161ffb698a9e375365f7a753e3027033c49c60378aecb1c66cf96480b2e5bb1b8ddd	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432657881"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d29cb14208db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000b8a674b47c6b107175791b3beb69574982552faa7ee241f2c165ab0fcf2adcdf000000000e80000000020000200000005016b04e3ea4d2ae73ced17f782dab65224a839ab82a2c9cfe0cd92948af874d90000000a81674c5c0bddcd915a2b9441274a21f0a846d3a3cf804e850dd07817a813bf7d654a495ccd8bcbfe1330751307c815de059528f033d8b280a771e4c57573a2928ade5f8b9810b0287c94e6e7383b1fb5d87d2b7da97a9318bbdef428db5d4d55770157289a31c30c997400445724caa29f20f66274ba1f9f8e9380f26aa3649f8e49a794d73c3dabfde456bd5dc5bb440000000c6cf486ce26599219c9c7d2692d249dcc386b64a82a43284c031c37718ff5f9acb4814f42549c25b52df51db99986c7e23eede1a4a2b152425cfa0a1df3d85c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB5DC111-7435-11EF-88C4-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2480 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2480 iexplore.exe
2480 iexplore.exe
864 IEXPLORE.EXE
864 IEXPLORE.EXE
864 IEXPLORE.EXE
864 IEXPLORE.EXE

pid	process
2480	iexplore.exe

pid	process
2480	iexplore.exe
2480	iexplore.exe
864	IEXPLORE.EXE
864	IEXPLORE.EXE
864	IEXPLORE.EXE
864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2480 wrote to memory of 864	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 864	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 864	2480	iexplore.exe	IEXPLORE.EXE
PID 2480 wrote to memory of 864	2480	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\W32.Mydoom.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a791bf33def868bfa81d2a7a7c6bd8

SHA1
8dbb54f366c5907ef0098a2d2153132fa2e50f87

SHA256
91bd71ff34773b38980d51ca124c3b564e03432db7c6c39714e7d054c2e01c4e

SHA512
24088fcb46d7707231f9ead45f92fe457e7119db807a8dfb01e8f84c34458c3f8211cb51dc32bc897571612f2bfda00297e6d4ae674970394b6130aabdf87c13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bee111724b7704739c852db27f8655e0

SHA1
eca3ec24f720ee01556293076feea021ab9f85e5

SHA256
8b85836f1aa88279b06b25c1ca420ae53f68ffc1811d63bc51ca0eb96a58cb2b

SHA512
20a66d6567e1536cff052a7696ceb800ebc1e9ed732611e0aaa2f399fe222b1f9db025388ff872f7529e31ee5670fe6584eb613799b33b2696e252838b493401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a81baabee5c3db5a9ad2e81d0999c566

SHA1
671ca650ae8ae37b8ae25b706060bfac29c5cbde

SHA256
7cfdaada51fcfb0a509138d9810ae7c91a331d8867963d29883d3358ea461df9

SHA512
0ee281c143dced95346ff97a2c4ad0e6330078d21515b5df44a98f9924e5e173e2073abaff6b3a5d4fb2e00612bb1e8c3723e0af0c9a8f525e80522d0531c586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cd702d3c223e78afbe71d2b4f8c92ee

SHA1
973875cdfd3071892104a33599317561a60a3b73

SHA256
f76452f6b21352b4db4529e7c7b2c7c0e5ef60d178de3f48b4c8e83c3b050d3e

SHA512
c462e72017644130fa63c8c55fb2cedb830904233ff470bfac77163f9276fae81b41b22d56ce971818cf9de41090239f5f3433128a43c1ad3fab49380a55437e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2c551204770fbb370ebc12b8bd2f30b

SHA1
5302074a25a611de933d095c087165539d12e50b

SHA256
e40d7d304e2d223dd4c3ae66eb15cad088a50f37a8bb8e11892489c1fbf00c56

SHA512
2f8539d153d2f9d61f78ad020716d1d9efd3cde0b834e6b0c6da07b9679ab7ed018ad1c0f27bc87f90a060e30caf8f4f91d222c0ff3ce1a52495d4919b1c572f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c2d987f6a6559a813ba40391371e309

SHA1
338b13cd1adf4caa287e3207077fb70faf9050cd

SHA256
f8f2a3009309be5070b07a4f773e99d009fa51a8d9a31d86886758eecbb13ea5

SHA512
26b1e56168d80cc6a4ae319ba26704c28b5a6ec75636cc7a8ba8c2fb2b381ad4dce1568cfd8e67ff3c11cd03e539f61e91a3ed4088e59859a037e4c3a175f987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1202ba8851544f8a32679263dadde0de

SHA1
9223eced9b534a482241b5cfd4a863156d589d50

SHA256
545ef5cb208fbf55f66d08c584f9c879d5c3432f2ef3d77541b984e73c1de8f7

SHA512
c4bf5a5470daa08cc8ba48cc040590af0ea16ba258554fcb14c97df298966f552b25b66d401b1ba69004851e320d9bc4588c01a9cf56ddfe7f09203b0499a791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ddef7421369369fd52cb630101ba783

SHA1
4b77699eecad84e23071cd6595b89ac17b6ba8a3

SHA256
ef832a9f722b3d9092f35c1c7c25c78bc1df1f19885a020a968dfd46cb174693

SHA512
1ff919106e6866d1d6eeffc2ffcacdd40b23d7868b9a8265332c1029b7ffe7310a5dcf836eab16dad7df6c66134e31a1ca36a478a7ad2449dfc3bbcc9ffaad00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d6a7f0d616745e0b3403e133ec42b0e

SHA1
46efa38d4ba1b8e0711686591a168adc64f0951f

SHA256
94e477cb4515f6e42f6d62c6d1b5c15476a18ea3146bba8042361c8c3b262cc6

SHA512
2af0da495fbf2cdb6ef27bfa893b93db96cd7219e6dfc1c9af78398a4cb7c375313604e027af20814dd8dff33ec7b2bb88550aa3b27aa4c509f66e8f87a71ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb54036fb3d789d310afda7f4cbfad9c

SHA1
6d3f2611b822a2800b6a8203f039fa5af144d147

SHA256
373f27a5d824aadd1e0bb26fe52d9e95b6db7983e8546d105886b5a8993fe03f

SHA512
e05f548d8d0d929a425c794c65bbce1d1c9ad13073caff9bcc539e7de57b81786ad8ac909e7f3846caaff0bb59ddd0b10e2eee438df6b420049de09730a121c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c4948fe490eb2063664b7d46e197e4d

SHA1
c1c9c694e75daedf5816e860042035402ab29c37

SHA256
a6e5fae6bd2b485427cfdbd9693bd4064ea4c4691a47d11a40579c7b23086ae1

SHA512
05e3f5609fa949ab31d06d7e99dafc0307f9c5ae3bae7dc8a9ad7220fae002fa10613442ac8a760418e50d65f3b5cbe3934f0f19e6a9ec7e824a34a9d93f520d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd90e6b01e6d1b7ebaa85caaf6033d7

SHA1
565345c4c24b057d4b008fa08db7ebd1577d2cc4

SHA256
1a46d3e3668631c5e27e4390761a4f7349f2c7c0981e33f16231936739bbf111

SHA512
485ea0943b6137385f5ea46488b3316a6c8fa83e6ad7293b81b7553d36f252fc9faae0fe9a73f9bb3622d476b3542fbd0a225b7bd7be3614aab26b191ed620f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a346b1188a52c68902569662944da4

SHA1
459c1861862b7c615de79efcaacbde0ab6bb7ab0

SHA256
3deea58568d2a21f2951876e58365939bd7cb9ee44120d0f358af7213567f374

SHA512
43b770a2e0e8da011d0dda7924ffd03455ae397527727c93f49e5f9c6114e2c41afb5bb2e36c15f5f72e3700e257b42c3a92ae38ecada3053330ad5150f5c145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f37214ad976da9273c41c99ab846364c

SHA1
622ebc903d1b8d410c393a5520f12630162dba3b

SHA256
33799ac97dc143d88aa34976b720873080bb29ee1fb3f5247f70c2262ba28d71

SHA512
e9474cfc6a021476818c58dd20dd775ac71260f80028ccaa25fdd85d1528bb6623a9f4b4ef60c1c700126b8526d4cd2bdf1fc899ef9c70bf9a7f4a85349126db

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF470.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit