Malware Analysis Report

2024-12-07 03:00

Sample ID 241110-2z8b6axejf
Target 5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3
SHA256 5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3
Tags
upx mydoom discovery persistence worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3

Threat Level: Known bad

The file 5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3 was found to be: Known bad.

Malicious Activity Summary

upx mydoom discovery persistence worm

Detects MyDoom family

MyDoom

Mydoom family

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 23:02

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 23:02

Reported

2024-11-10 23:04

Platform

win7-20240729-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe

"C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.156.133.4:1034 tcp
N/A 192.168.2.18:1034 tcp
N/A 10.152.243.207:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.41.4:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.14:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 172.16.1.165:1034 tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.gzip.org udp
US 85.187.148.2:25 mail.gzip.org tcp
N/A 172.16.1.165:1034 tcp
US 8.8.8.8:53 apple.com udp
US 8.8.8.8:53 mx-in-ma.apple.com udp
US 17.171.208.6:25 mx-in-ma.apple.com tcp
US 8.8.8.8:53 unicode.org udp
US 8.8.8.8:53 alt4.aspmx.l.google.com udp
US 173.194.202.26:25 alt4.aspmx.l.google.com tcp
US 8.8.8.8:53 smtp.gzip.org udp
US 8.8.8.8:53 search.yahoo.com udp
US 8.8.8.8:53 search.lycos.com udp
US 8.8.8.8:53 www.altavista.com udp
US 8.8.8.8:53 www.google.com udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.23.210.75:80 r11.o.lencr.org tcp
GB 2.23.210.82:80 r11.o.lencr.org tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 192.168.2.9:1034 tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 8.8.8.8:53 mx-in-rn.apple.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 17.56.176.6:25 mx-in-rn.apple.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 8.8.8.8:53 alt3.aspmx.l.google.com udp
GB 142.250.179.228:80 www.google.com tcp
TW 142.250.157.27:25 alt3.aspmx.l.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 192.168.2.13:1034 tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
GB 142.250.179.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 142.250.179.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:80 tcp
US 209.202.254.10:443 tcp
GB 142.250.179.228:80 tcp
IE 212.82.100.137:443 tcp
GB 142.250.179.228:80 tcp

Files

memory/2084-2-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2084-4-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-11-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-9-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2084-17-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2084-18-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-31-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-32-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-38-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 df65f42ae716561ea175917d280174a5
SHA1 33ba9e7c11d2608a41bd1a7b5defddef64f7d413
SHA256 0929e625b8c771f3d4eb3eb6011ec5bfa3ed3846b993a1159921f2a7016e99b8
SHA512 2ebc67249650655fadf2e331a242ffba0146c6ba6c795d74053584955e50714a130d5e7e65fe4814e7dcb6db8d660846c1d1f4b6eba58f99e4b30c356a0bd585

C:\Users\Admin\AppData\Local\Temp\tmp866F.tmp

MD5 623a1d38080c8bec9c09de6694f31424
SHA1 1d5c9f380789b481bdc26e888bb579975d1013c4
SHA256 5a470dfd7b05ffffdd06c8c817b2c4fe961de95a9a0f6b73179d56431fa31229
SHA512 a659d314a6fe84ea1cd94e8bc674178cace7f2a26a10d1897c275f0fe22bf5db66547b0abc31278d3584228afb79c67a85324aa63912f76b8d1abd9e62253ac5

memory/2084-55-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-56-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-57-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-58-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\yrwaaf.log

MD5 d537b80e818926cd8859e1d73e3a19ed
SHA1 36de2aa277e8cbb3d23d0b4192a99e4a212b5d0a
SHA256 37ceb2a5260e239bd3c0bf9a2221372d1cd61c30d9afe93273fd2337829aaee4
SHA512 5377f65a21191967c2447fbd76a835a0c8bf007ee46c8114131c8e92d913a935396e9780fdff674e06db67c3121042b2aa43bfff0cbb1a35ed046b988cc30635

memory/2084-62-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-63-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-68-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-69-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-70-0x0000000000400000-0x0000000000408000-memory.dmp

memory/1700-75-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-79-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-80-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 7d8b7b838656dd4744aa0f97cfb902e1
SHA1 5e99b5e75f2623eac7ef0abe20ec9d486e015d33
SHA256 c55a74004662824668db3543d326c3e4c0b75274edef7b8f59720fa98b8c1754
SHA512 bf3ef5469b0ec105ae74f338bfea0aa7b9458614a2e718ff77cf443ef77d306ada04883e820747b81ba918c42e05263f3ebf6f36f9aa649cbc5bbee5d1e97251

C:\Users\Admin\AppData\Local\Temp\Cab90E2.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar9163.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 894274a7af3449bbb40419206508ffd2
SHA1 4d94d9430213da3021d201bf042e7b1ff3c457c7
SHA256 0d7ccf0a7fa102cb1055586eef035f559e143da5f3fa14aba841d10eb81c386f
SHA512 450c021e130067fdcd560bfd4d002dbb959f9a16eec12ec2e384b8247ed5f5a9b7b48ad81942e81eaecd6e58cacd51fce9e78ba1bfae19532a3a5675c95223b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee125c0cfa4dc5c96f0414356045c4c2
SHA1 a8e1bf567b7528f83b54007c042d8087217f4d1d
SHA256 e08ced225855ef4b2bf0705c672a466ff2ba798b9bdb1d8d23b02bc280932edd
SHA512 9479c50505e55ede7ec371ef9a621ba5354613c2ae5d2d7f0889e460dc6f0788c1276459a1ccbf110b0f663eca41dca6f0b4b392fd9d810d8c4e1aa34c180263

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\search[1].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/2084-255-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-256-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2084-345-0x0000000000500000-0x0000000000510200-memory.dmp

memory/1700-346-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\default[4].htm

MD5 157431349a057954f4227efc1383ecad
SHA1 69ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA512 6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\default[6].htm

MD5 1ebded2bdff03c61ff9bf10a846c8175
SHA1 cec89ec07419370a2c8d88a66ec962377b2b1d78
SHA256 8e630a777fe81ece337b95ef20157d4201620954f569edac9b25b5b03addd276
SHA512 6624ab41f0db4b549bc7c5fe8af8bfc8630256107f52e9756f50a4e1d76d212510a287d58c4ecf4de71860c970569059d87c246debf816885a3f7f2b480e32d0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\default[2].htm

MD5 ccfe63b884fe4225fa33f618a54ce37a
SHA1 bbb0778c1597eafe7fb9c5c65412f8ab04b2e311
SHA256 f7dd5bab49466a4cdb6a7f5a0e07a158f7a1567bd809ed745812469775b33112
SHA512 858f345503c89ba075b374764145fba5b1a9d3440d1628edeab0a3e02cc7cbfbe1119c20747026e69d630ed262d3c91c5073ef06823cf727dfcb11605c7c5ff8

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\default[2].htm

MD5 14b82aec966e8e370a28053db081f4e9
SHA1 a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512 ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 23:02

Reported

2024-11-10 23:04

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe

"C:\Users\Admin\AppData\Local\Temp\5dcca60acd75f18f36dd6bb5485fb709ae3c04ed9d4cbd5637570362b544f3e3.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
N/A 10.156.133.4:1034 tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 192.168.2.18:1034 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
N/A 10.152.243.207:1034 tcp
N/A 192.168.2.14:1034 tcp
N/A 172.16.1.165:1034 tcp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 alt2.aspmx.l.google.com udp
SG 74.125.200.27:25 alt2.aspmx.l.google.com tcp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.1.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.52:25 mx.burtleburtle.net tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.41.0:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
GB 216.58.201.100:80 www.google.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 8.8.8.8:53 search.yahoo.com udp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 search.lycos.com udp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.23.210.75:80 r11.o.lencr.org tcp
US 8.8.8.8:53 100.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 8.8.8.8:53 75.210.23.2.in-addr.arpa udp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
N/A 172.16.1.165:1034 tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
US 8.8.8.8:53 aspmx3.googlemail.com udp
SG 74.125.200.27:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.79.30:25 acm.org tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
N/A 192.168.2.9:1034 tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
FI 142.250.150.26:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 8.8.8.8:53 outlook.com udp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 52.101.41.55:25 outlook-com.olc.protection.outlook.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
GB 216.58.201.100:80 www.google.com tcp
US 85.187.148.2:25 mail.gzip.org tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
N/A 192.168.2.13:1034 tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 www.google.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 216.58.201.100:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 216.58.201.100:80 tcp
GB 216.58.201.100:80 tcp

Files

memory/4560-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/2148-6-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4560-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2148-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-38-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-40-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kcwaEvxwxU.log

MD5 b67976aede592f84d713f2a5641d605c
SHA1 cb845006f5fde139b0ce24489b7a890691ad34e3
SHA256 89f87df6c34dbc5e196fa642fa5462acddbf4fe7757c495d0a3cad5607b25c55
SHA512 5ae9722c24ca4d1c3fed51df9cab4c6e79c7907c0db21e951a1490850b13ae9553c99c6b1bff5ad7d9e466648b1623d40f4b69483f7ec71dadc5f56ff3fd50a2

memory/2148-45-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4560-44-0x0000000000500000-0x0000000000510200-memory.dmp

memory/4560-49-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2148-50-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 9858a6debee241fc449f03fcf0d1c5be
SHA1 ad8d9206200c4f3df7070aef77e4b5c6ea421dc7
SHA256 5d84bb186ba1fcedf34e580702d582c575bb3862e27b60ba623f9ce12601c525
SHA512 cc94fadb71b1fd0c61aa51c5665bf6ea5c9d66eb10922e8362e1ba0fcf220a52037427c25ad4d45787a0997a17cfcafd06a35a6722084941bab53ceace2cf172

C:\Users\Admin\AppData\Local\Temp\tmp2E1D.tmp

MD5 4157c499dca37fdab8941809ea07e880
SHA1 002019e277a3de26e895a46f3f977b305cf6c92c
SHA256 605b6c461780d22f88fdf361a06860df66d3cf8c1ac40125100179555a2a654d
SHA512 1c3cf84a025129d2149c3c3cd721470d9dd128cc5fabbfe65797f188e409dc357844ed1722a8c0b33cd0a6dc758ea7556d035c9d41dd80d1d8dbc99bc4cb68c4

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\search[1].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

memory/2148-137-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4560-136-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 3e3cb25b7ea0a415acbae9516c602a99
SHA1 13dd4caeb5f2a5cfa771766091db6bc16be14b66
SHA256 2ba6f1bcb90e45a0da370d64fd912d7e00a88d8dbd13c63c559f2f3e39f7423e
SHA512 d23fc967bad700bba22ef2de65b28d02d9d01cd94c93399b3bfbe8529a578034ff91cd9e4050621b132f00666f6a03e702a8bb1a889e6d8f1a114998050eca5c

memory/4560-171-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2148-172-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2148-176-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4560-177-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2148-178-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 455a055bda57468841e594a35427f3cd
SHA1 6548d8f6a2c8291ce0a55f61cd855cd5f3de6b06
SHA256 b384ba13deddac2e6be4fe4459a0de6a0b6c489543f9753114a9dd704c456781
SHA512 b40f868837cd51d34578befd474330f13b6222596710d2a95530cb2e8b741d36b4247efcac2a035a38d240bdd55b4d7f8c32aff9e1e750ebfe555bf38aff46e2

memory/4560-203-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2148-204-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0TSRVAPX\default[1].htm

MD5 157431349a057954f4227efc1383ecad
SHA1 69ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA512 6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284