Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14/10/2024, 12:19
General
-
Target
990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe
-
Size
41KB
-
MD5
1a0c4e6e0d2a881092029f8faa817d80
-
SHA1
7564b91ea47541fde68b11fcaf4ff58895c716ba
-
SHA256
990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6d
-
SHA512
c6a6f3a125039b65361d76d018efa3752c5f413abab9a64c04270a70af8527da90ef7c511d23b5676fa7fec1a35ee09c54e7136ed232a4dda4e00ee485d8931e
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe"C:\Users\Admin\AppData\Local\Temp\990aacea8650ad362dae2f5c9b2331f121391937305cf547daeb6d1940973f6dN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD55806b9d81fbc15a13e15ad6b17305ca3
SHA16a5cd2ccfa5967175ef141d18e5a54fb79867322
SHA256d6447b47b618e6b584ecbc1aed429421429fa3e191db3bbfb22cb88794120d95
SHA512edf78f7298200c9d727a1c494dba126c7c1f5ac8b074af5fccb994c060340ccc76ccfbb245e9a0eb5f9d4be48067b3b650d3f2521362d301eb7f2eb7fdd6e7ca
-
Filesize
192B
MD5bd8984c7378ee8c94a3a9f2679e48fdf
SHA1e57cb9af26f2bcfb6bd55cf4c8238066ff3fe8c7
SHA256ccea7c3f031c34396dae3be1e6256e2d79cdb74e0e69ea3bc5805f645afc31b8
SHA51291b18782beb9becbcfeaa0d95d48cca88f9e885b6761d0fdc34b1902a76376b9a53acf9a7c8bbf1deac7e8ced5596d57e7030bf97de6f48488fa3a987aa04e7a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB