Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 22:43
General
-
Target
555244561a438c4f14388d873e81c4ac0948ad100cb80d354267e50eee8f3317.exe
-
Size
29KB
-
MD5
1902b6831fa3d25fd6aea69de3dea079
-
SHA1
5a28be8a28bb2de4c2cf0f16fe9b0875f8ecaf19
-
SHA256
555244561a438c4f14388d873e81c4ac0948ad100cb80d354267e50eee8f3317
-
SHA512
45931203dab276746b98fa1264f847f64867229677a291dc3b755eb79270db7e267047d7604f28e984e395fe6dcc67d5f4d3d5cdda85c606fa21253a4da8b346
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/s:AEwVs+0jNDY1qi/qU
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\555244561a438c4f14388d873e81c4ac0948ad100cb80d354267e50eee8f3317.exe"C:\Users\Admin\AppData\Local\Temp\555244561a438c4f14388d873e81c4ac0948ad100cb80d354267e50eee8f3317.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5d02df24b91afbf6c543e3fa47b546c14
SHA199581f19582a694349becf893f7038d92d8b44c2
SHA256cd40a1ce5ca64d9895071275afb89d9d4fddea4a049a019405c45add359ab95b
SHA51250ea51e5194729372f79b8b227980e2ed4ac79424045e4e78b2cc5ab7f88969581d9fbf5fa8f784e0a0fbc6372755982f04f949538bd97b7606b06f227ca65e9
-
Filesize
362B
MD55e8e848aa0385943c85c270964cbe158
SHA166e11beb41cd945f28e3c4d5241d74f0c35793f2
SHA25664b5f7f5e1037a82cffcc7793c4dc5940668a51bbb8f584b2e3c452e1c0c5303
SHA5128dcafd98b25faf60c221807b8805b296eef9fbfed90882074fcdf59ef5074bd001204a4b9c314d6ab09a096b62e791492d6d7d76104d38d9769a20d2e768bb88
-
Filesize
384B
MD5dcbef9fbb59439e4f0b099d021490548
SHA10a96b07f06737ecd5c4bfd45fbb6c9e59b9c7ed6
SHA25633796c1bf8179e56bd976b584e5389c37646f149dee5312b1c35b1d1c7e49ba7
SHA512fecaeb4b9d28f1d1fa505af6a20cad4c08c9dfdf38cbe74a796840c549d9f3f1726f6f025f9fcd7ee05aa7302c15b38f9936a49bb1ae22d0f25156d596a3ac6f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB