Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 05:34
General
-
Target
f2f4ac462be392ab56df180f6cb428a9d694ba0ff0b2a35480ab1fd94a363e31.exe
-
Size
29KB
-
MD5
1b556a075424375de88dca57285e8a75
-
SHA1
189579cbdaf2dfb6245cb9300040be6d49bfdbb7
-
SHA256
f2f4ac462be392ab56df180f6cb428a9d694ba0ff0b2a35480ab1fd94a363e31
-
SHA512
70248007f9ff8f36dcf5e0c759437e73278509ff91b08b818e2a650b1434f6b613bfb391da2b62557a0ec7b0a5485bf91c828e1cd7d3b920bd6904653e353f56
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/j:AEwVs+0jNDY1qi/q7
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2f4ac462be392ab56df180f6cb428a9d694ba0ff0b2a35480ab1fd94a363e31.exe"C:\Users\Admin\AppData\Local\Temp\f2f4ac462be392ab56df180f6cb428a9d694ba0ff0b2a35480ab1fd94a363e31.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5c07bd75789c42a08ef2ef0e49657d714
SHA1b8847bc5360f930ead685451216ec185366dbfdd
SHA25642231ff4ddb65cf0a9f9a3a6d4a1b8ccc44cb2d6be6c58eceb63cfc893bd516d
SHA51205109a1c38365fd27111025626bea1bfe7206ba829f9f9e2bc1330df74d5a686fbdb5a748e3f14a6c8b82219d626bd091f73a4a057bb31d8ddc3a02d7d1f9795
-
Filesize
320B
MD57d177afe9a04946ad7a2961b085b94ee
SHA153b6c20bf4a80212260172f442ec7bd78ed6c232
SHA25665d4fad6483db3fd678e21fcaa0ee1de17a665b89ce8cd68bb072bdbe86df9bc
SHA512559920cc6bafd3637ffce47e323e78803631c43ce7253ad0f610d81c94972c2dd3bbbeab9d385043765329109680e29c9205524dba013e381f091bcac0faed87
-
Filesize
320B
MD51c5ac4dc3aa5ae3c3b6bf7799bb1bc59
SHA1bc95e44f5a8e8cf4ccc6d91110aec53df8713f6e
SHA2566e0f977e2a62be1c9d42b6e0132caeeb57a0bdbfc5ca18007eeb56ec067c7635
SHA512144d2a164039914142218f512d2f2162044ee63e2dd4768be711c103c0f37bc00516c47cfeee8ee9ab7e8dd48eb1ca4e96e1dfe4b4ede89e87da9d09fa607747
-
Filesize
320B
MD553bf3da01f5d049f856b9408127739e6
SHA1bb173a64fe38a05d4dfd52abaf75cdef73a69a36
SHA25606d1df5255090f3543eab2258b611c872fa5b00dd963c54212eeb56ceefa2ba7
SHA5127fcc745e978105b4c48982adcc571bb71692fe476b5ea342fd907e197d867beaa7966dd2407e482f633b25a92cad9229364a58cbc3be9a3b4c41d68aa4d7d53e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB