mydoom | 4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2024 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
Size

29KB
MD5

6b106d1bbe9e567eff7ac13edce63811
SHA1

5d60a73df740d3319bd0f8a8cec249eb07787641
SHA256

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373
SHA512

959e315020531b4b11184ad7260487f1385019bf00c87a612b2802505d5dbd42961692373855222de5df856976da25644ce2a9a228ffcb05907fb83efd1a3808
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/I:AEwVs+0jNDY1qi/qA

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3576-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3576-37-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3576-125-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3576-206-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3576-211-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/3576-218-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

548 services.exe

pid	process
548	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3576-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
C:\Windows\services.exe	upx
behavioral2/memory/548-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-37-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\tmpAE6B.tmp	upx
behavioral2/memory/3576-125-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-126-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-206-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-207-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-211-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-212-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/548-214-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3576-218-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/548-233-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

Processes:

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe

description	ioc	process
File created	C:\Windows\services.exe	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
File opened for modification	C:\Windows\java.exe	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
File created	C:\Windows\java.exe	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exeservices.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe

description	pid	process	target process
PID 3576 wrote to memory of 548	3576	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe	services.exe
PID 3576 wrote to memory of 548	3576	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe	services.exe
PID 3576 wrote to memory of 548	3576	4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
"C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\search[3].htm

Filesize
139KB

MD5
79f843fa60c60b247a95c42c7c7dcf66

SHA1
238341cb81d17b5e2ee2faf0a62d88c8c8be7628

SHA256
35461e996e566f72161338c1e9e1231b929d13ad666fc60e403d03ae559b5661

SHA512
31647654545b097e94e3a513c1f6bb0e998ae6f9659d2dccbcac7c241e66cc3273b6e8e2dbbc4dbe2a12e59f0740c51107b0452753774fd8a312d6a0b9d3558e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\MXJ3XM1Y.htm

Filesize
153KB

MD5
0a507e9d41de7777f6cf8ef930b7bf0d

SHA1
c96fa29e640b7f142619397fc8832a14c7cd4cd5

SHA256
035bafa9e612907398fa3142694c3f0f72946b541bd4e4472c006c718f45fd83

SHA512
001dfab8157bb58dc3b851f59450dde8df74a07e5393b2933cc171d6928ae0085e9b200381410a6426f9928597251e7cd4fcf9277d11242b3c5d46a924e171da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\search[2].htm

Filesize
140KB

MD5
fc86ccc04eb29ec00ea0185de02e47af

SHA1
42905420d3f6c177dfa8854403511dd0ad0570fa

SHA256
7691935bb7171451ddb3e4513fb614a4b1ca3f31146db5ec8095f4b97ff450c9

SHA512
4d0528e02f531aa62655fe305ae12e0255d4f2a87b8ffd339e7cd57dc3b55818b25e9c6d4163f4f823253842c460cd4d4a3f02a87d174aef8d43ff230f3d0517

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[1].htm

Filesize
132KB

MD5
34aa8a053a3e11cc53bf0f20248e9003

SHA1
c15188ccafc216905c642f53b1d00b6cf1882e84

SHA256
8d462d6cf4e35e1207acebc462c9320caa9e93d89370affd4031762801e84e6d

SHA512
fb13df76024cecb72cf4e77f24eb7a1aa28c5705366108e8ba143da78d17167a99d3e4abc5227e480137cfade1a5c40423c9596d6165477c10aaaa5a4fccfd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAE6B.tmp

Filesize
29KB

MD5
7d6c29b796222760f10a16a214595b8c

SHA1
d7c38af63ee7754c84ce05b4577bcde4da0a4eea

SHA256
e65b79f29c4acc882ef4515911cfed0c9026ef2780b25a21600dcd39edc701c3

SHA512
236fa43f85f651c656daae7cdb5e98f303e00ab319e20d96c854ba214570a6c74b2b1a359e25b1467d95eaad23175d68c87c546493963f4fbbe1eb78f0462acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
811f91fe9381b33342e7b81c6ffebc0d

SHA1
3c655a7c8d1af317a1f703d904a8e40b0820e66d

SHA256
1cbe65d64973ad9d0e2eacd6168ccc37c7cde0220acbad316101dddc6ef7a9ac

SHA512
41dee0f7ccee9e298b84a6a3598a32ac57fca465d71872c9b91cefa0fb36f0bb0b6fd03c93a0610e8cceac3d4fd0821eca98d71d7da1ec2c4275abd9dce76af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
6f534f1d9b99c25a1130f7ab1dc91025

SHA1
b119bb21b51783484b1c82275edb5b4ff0a99688

SHA256
4d9705b3bffbc561fc7570dbbb2bdc2bbc3e00f31d4764408229719a0a3587ad

SHA512
e8358808726ebe6dfc8b0e993460ced18aeaa9ce31f304764a25a8b349bd36135a20c7307c4a29126ab58149c97d5ecf04c4d6dd8b5f6d2ec0a4de50f058621c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/548-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-212-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-7-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-126-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-233-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-207-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/548-214-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3576-37-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-211-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-218-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-206-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/3576-125-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download