Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 09:47
General
-
Target
a4f836ad471eaa69f94eb2e92c343e7ea852b047b5cb07022178fe1d8619b52c.exe
-
Size
29KB
-
MD5
d0e8b5ef4ef452c562b7ab76d724c5f6
-
SHA1
d0ba831929f115442067d0cc2a977090f86e3202
-
SHA256
a4f836ad471eaa69f94eb2e92c343e7ea852b047b5cb07022178fe1d8619b52c
-
SHA512
39e0ccfdfaef935e39652fdc1dc5edef73e382dd0473ef2097bd17d49731fdbaefaf9b36b1c429484f07000a4748faca70c0ba1a94ddfc0ba40587f678fab33c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/e:AEwVs+0jNDY1qi/q2
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f836ad471eaa69f94eb2e92c343e7ea852b047b5cb07022178fe1d8619b52c.exe"C:\Users\Admin\AppData\Local\Temp\a4f836ad471eaa69f94eb2e92c343e7ea852b047b5cb07022178fe1d8619b52c.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
29KB
MD5ee9c63bb5c6950f5362ed96f24c840e6
SHA192fddcda9e9bb84558f60cdf5ea0b1ee6354a730
SHA25608a3012ba7b0d9b150bf650645c0883425d0205050d3b1741cb766c3e1c140e5
SHA5123e6b0239803e1a4996f3309a1d0fc19a09fffc96964e654d99152a573e9a09a9db77d8b98654b5b16d1ebd0e982d817a32a3e6875961256d6f08c088379a50aa
-
Filesize
320B
MD50c982c30c1873b2139fe9054e5e2b8d6
SHA1cae38352b3f40c3064c1d2c97949d5e0de9e5547
SHA256780acbc53175c4aa52d2f13f9d61d6d1849e094f7791bf8a382b329f53baa633
SHA512fd634fdce5069eb779de330cd9232d2be4b3b42301066b5176333c499a8f16a924c7c2c5fd82201ee81ca50273727bed6b4729e4001e344e6831a169a712e89e
-
Filesize
320B
MD586c2c28215d5a7fc1f0a3bac88a7f45a
SHA1197ad1d644b80bf27ad35bae51bb535b76c261db
SHA256bca50a91fc907c00b107c5c5372b9cb2737cd59b9f6276e38f8c5d5d07c44930
SHA5120e2fb9ba40ead96f5cae0f62cab97e6c62e843adebf4eb497b89e4db5edbf85e48189ab07a0ec0be8e48d778fc5b0737487bf0d9b48674feecff7a8703a89d93
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB