Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-11-2024 20:16
General
-
Target
1f30fd3892c9437c992562475c6783ad9e2d1faf3d3a29f6c16f4a41395132af.exe
-
Size
29KB
-
MD5
cd2091595f3d79b0e7cc920bb6c6876e
-
SHA1
2cba9fb535490d0f41d03a2e2006106e492d6e94
-
SHA256
1f30fd3892c9437c992562475c6783ad9e2d1faf3d3a29f6c16f4a41395132af
-
SHA512
15752102011813ec3b6c10224dd429038f0daaf81533b0958a2ad5dad74e0e3aa375e28ae5862ddd9b6c2facaad375ac90facfe3442c448e7ca8b6a53fd7d2ba
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/2:AEwVs+0jNDY1qi/qO
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f30fd3892c9437c992562475c6783ad9e2d1faf3d3a29f6c16f4a41395132af.exe"C:\Users\Admin\AppData\Local\Temp\1f30fd3892c9437c992562475c6783ad9e2d1faf3d3a29f6c16f4a41395132af.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5b1ce3403d6550e39dadc133beeb6f141
SHA1d78b329b586f9b36dc42d946258c8cbd83277ec3
SHA256100f73255cbb7cb91b44c24a2988e5d2e08c520adaa1e9016ec0bf3317c1a7b4
SHA512f57f81b60ced1ba1a2e74eef00ef1aeab7afa274daf17765a464f12c69cc539964e99f4011bab6201e5bb256bd162aa3fd992474d48b5d15a67555164eae4724
-
Filesize
352B
MD5ed2f83ef8e2d1d7fcef1fdf7bbe30b64
SHA162108495d74ce45f32df98caddb89e1a2ec07ee9
SHA256a01cd7acdd59e1dd93f9b35cf1b85b5243226a99ee68348ed58fc33f45b24a6a
SHA5129307767f3b524ae7a323a5dac5d5692580e55e31c46c77e823e03bed4396d858dcd4d6a83e9e3c9331d3322410ad795f1901722434cac101fc0a38288e4cbc27
-
Filesize
352B
MD5df00e542292d0fd93c0b38e87e05accc
SHA1a0ebf0c95e6e13dd38e5baa4b5b819c5bc978dad
SHA2563001e10a7d2588ef9c6f911e41c9006d5b63ca02f307733561694967edfae5e7
SHA51235a9bd646dfa2b8a3b807b975d2d6860506deb7d179ad301ea2b651aed3886f96f79740e82bd73d006b172138482f751dfc3a87585216fada583af6a3a3d81d3
-
Filesize
352B
MD550b85f3865d1e8704236ee1d1540c475
SHA1dafff99479b16c080c3f83631ee83a50f4b90249
SHA256fb22c7913f190ffabe0bb23067873eae708660c5304dde06f4a7e742cd838199
SHA5125eb05b8bb393cf2969cbca27142cff3f448bc9184f2f8c5f875f74eba6a1428c9b963f83996099f97996be1d93a9cae03c9a68f9391eb7ca88dd16681fd774cd
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB