mydoom | 7846b711aa4b48e6175a04d60ebd29bfd298fb82e8cf067485d172d59ecf36d7

General

Target

9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
Size

48KB
MD5

9a832ce990875b406c0c365899db74f8
SHA1

ca1c4fbf34fc2ce092edf027db2ba55dc991170f
SHA256

7846b711aa4b48e6175a04d60ebd29bfd298fb82e8cf067485d172d59ecf36d7
SHA512

fe7e7624162614280d89972f4f86286a268d37b39d12e0ec2e30ca94ffae4d7068a7d9d67bb9a6d1049ac6cae862eb653561fe9d778f2a1073df64601a58d3aa
SSDEEP

768:jv8IRRdsxq1DjJcqb4ZORE2t+/zCB3zNO31RBvphxkPeEXdLmuxah:DxRTsxq1DjClOR3KzmoTBvh6eEXNmuAh

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral2/memory/716-21-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/716-71-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/716-148-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/716-183-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2392	services.exe

Loads dropped DLL 1 IoCs

pid	Process
716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcmgcd32.dl_	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vcmgcd32.dll	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/716-0-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/files/0x0007000000023c7c-12.dat	upx
behavioral2/memory/2392-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/716-21-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/2392-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-46-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/716-71-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/2392-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000000709-73.dat	upx
behavioral2/memory/716-148-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/2392-149-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/716-183-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/2392-184-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2392-188-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File created	C:\Windows\java.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\JAVA.EXE	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SERVICES.EXE	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File opened for modification	C:\Windows\SYSTEM.INI	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
File created	C:\Windows\services.exe	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2392	716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe	83
PID 716 wrote to memory of 2392	716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe	83
PID 716 wrote to memory of 2392	716	9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9a832ce990875b406c0c365899db74f8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\azlQy.log

Filesize
1KB

MD5
ee2e7bcbd429ebfbae57bad6afd82054

SHA1
1ed8273266ded212d0bd938d4293d66a849896e1

SHA256
7696ab790d406f2b4183911372e23f03f6d421ae8d6f58d034dd9ccfe17916b9

SHA512
35f11a39403c510aff4b90efd340ce08cdf97dc0931d81d7120cdda8078b3eedb033695d3d4ad07d2e9fe29d68d01d83a7a88bacaecc6f3ea1a46f28f76fdc1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp548F.tmp

Filesize
48KB

MD5
1d8f99774bf0966f2cbd8dda6abc2dbb

SHA1
c1401ef3bbbb6c4b751fb7c521fa4f427b64c02b

SHA256
a05ed965e200ed40144f71e99a61300495d754a84e8a99cee3ff8c74438055a3

SHA512
0be847ff03bbf828331e80f98af2eb9b67932aa72100a23471b63261e50189c60961ed6517d8ddd3632719ed663b7796ccc8848afe6f6000d2c91b87bc8ab3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
97af3918450c2ac5a495902887d2e3fe

SHA1
009046f30512323e9c285fc501c6191f5270a75c

SHA256
c4f82e62c5203458118cc9aa4ea3bca5a95282b35b98b5a04265d4128cb1c58b

SHA512
127dff989986616f4e50ac0865b2170decbed9b06c9e5734db8c4dc9f713815e21c7a35c0f11dacb9b0b607cabfc3411ebf7f9ac3f40bcc3ee8f647a0c4ea857

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
b344b8146e51cc3b59c78e6205208e88

SHA1
527fa8815b80a99e4821afb2fcc5a0f69fad3ecf

SHA256
83ad601e2f49f80ddf3271d4a46857a3fa348b5fa27c6ad93c8d6d4a1fb8a927

SHA512
9e61cda7d21fc9fe4dffcc747de8a823f6adb1b1adaf158d6f31e7be6e084cb2f3e1efc9c4b2526cf263c41c75407c68f25e0f005b0ba0cc790eedbc520eade8

Download Submit
C:\Windows\SysWOW64\vcmgcd32.dll

Filesize
36KB

MD5
ae22ca9f11ade8e362254b452cc07f78

SHA1
4b3cb548c547d3be76e571e0579a609969b05975

SHA256
20cbcc9d1e6bd3c7ccacbe81fd26551b2ccfc02c00e8f948b9e9016c8b401db6

SHA512
9e1c725758a284ec9132f393a0b27b019a7dde32dc0649b468152876b1c77b195abc9689b732144d8c5b4d0b5fcb960a3074264cab75e6681932d3da2a644bc1

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/716-148-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/716-21-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/716-183-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/716-7-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/716-71-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/716-58-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/716-0-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2392-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-46-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-184-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2392-188-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads