Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/11/2024, 22:23
General
-
Target
503f68d586b9610a296c28e22484769f0f66e76917f5dfea7d5acbcb187f42e9.exe
-
Size
29KB
-
MD5
ed34c070d43f87a5369958ec57b5d0a1
-
SHA1
8a90f83c0075e713c50e8abf7e9398a9c57d0b54
-
SHA256
503f68d586b9610a296c28e22484769f0f66e76917f5dfea7d5acbcb187f42e9
-
SHA512
f774a079d0d9e0e7416bec96b0f5f6e36c74e9b52d5c9b7feed8313709bc8913b0d98374979c9cd0aca0b2cad7b6cda0fe602eda640de1d2761871732c3b73f9
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/C:AEwVs+0jNDY1qi/q6
Malware Config
Signatures
-
Detects MyDoom family 11 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\503f68d586b9610a296c28e22484769f0f66e76917f5dfea7d5acbcb187f42e9.exe"C:\Users\Admin\AppData\Local\Temp\503f68d586b9610a296c28e22484769f0f66e76917f5dfea7d5acbcb187f42e9.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5c67da6c85c1327721799b7da901a8c1b
SHA1e7332c3b9693c314b0ef61d7821fdd29b64eb174
SHA256a11c6a8f5b1b2f0c982b59465808b4dda47749c141bf6a739c4ba28608941e05
SHA512d11a057f30eee45d652cb00eab1320717450b95227ad5bbcb6fa471d3981092520dc6cb0d028b95e7252660b8c4073546d1bdbae37aca3bf8c7e64f57bad2076
-
Filesize
342B
MD55651ed19eb46c853e670f6e103098db4
SHA110b7d25e4fff5bbf0d2a2d99b0953d76e3390c71
SHA256db85584d2c62ce543c824b3b5893057389426533d385c2c7979b2cbaaf118a8f
SHA51283205700c9912c434b41c9f998944a219f93146400bfb1842f9f3090290e517dddac5541a1a00396726f241bef2b06cf0765f8f61282a23e5eb3c91139ed68da
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
305B
MD5157431349a057954f4227efc1383ecad
SHA169ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA2568553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA5126405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
29KB
MD5c175d8244ce836b5c77e397846655a40
SHA1a528bb97ad469e07c3c6dddf7c66cfb42274455d
SHA256f1fc4ab55a31337f013e50587370fd06eba32f0885a24da0232f71d74879db68
SHA51298ad044b3da4a490e5ce27ad2bf56e6dac1392e5b88cfaf889768d851c72570e634bbed2a68cf4575f249ec9fe73fd94b1b7f99ae04c5e2f75e09c38df1b1c25
-
Filesize
320B
MD5b72c5157cc4960f051fe404e6211ad13
SHA1c36eea42c0d89864fc1cde4dea62de9080f1fcde
SHA25656131a3a4f9bb4d65e86d1f61d23336f584734a13739533e796b65207a742cd0
SHA5124bad88a74dfd2b1157bbd7844c4739f2aed18d4ce87a6d3a822fe5272154e30523f254095b4715c10797ab7d9ca34fdbb914444b42784213e0cd4d857ddd6985
-
Filesize
320B
MD53e5eb56244ee4cffa7048f36fa240b32
SHA1a1c2fbc679e145be1c4b0f40d6392e6045168838
SHA256f2a197507671947d19a2a448023ef0141093f7c546b1a12a47dd18652a8158d0
SHA51237acb56738bedf6fac33762a588e64b3b56024149123b7a0d3839e4c82c5c863b37bd21fafb85266a3d9b78bd59506d30ed433cf61fde1775c35dea8d2f14386
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB