mydoom | ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/12/2024, 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Size

29KB
MD5

73a3d606064a7160d17c5126b7f200bc
SHA1

42864206973b583ffd1673a769cdf895565ca44b
SHA256

ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe
SHA512

632952c14f8b52798904eab99c6e658ccb45e69d3ea1e71ea27d1edf9101c3004d4aca089517590873c9f09705a0db865e3c2536b9e54e3847e0fc171fddac75
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/efDuB:AEwVs+0jNDY1qi/q2fQ

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 9 IoCs

resource	yara_rule
behavioral1/memory/1968-16-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-36-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-41-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-60-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-69-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-71-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-76-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-281-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral1/memory/1968-354-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2376	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1968-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1968-4-0x00000000001B0000-0x00000000001B8000-memory.dmp	upx
behavioral1/files/0x0008000000019450-10.dat	upx
behavioral1/memory/1968-16-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-36-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-41-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-52.dat	upx
behavioral1/memory/1968-60-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-69-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-71-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-76-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-82-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2376-282-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1968-281-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/1968-354-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral1/memory/2376-355-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
File opened for modification	C:\Windows\java.exe	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
File created	C:\Windows\java.exe	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2376	1968	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe	30
PID 1968 wrote to memory of 2376	1968	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe	30
PID 1968 wrote to memory of 2376	1968	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe	30
PID 1968 wrote to memory of 2376	1968	ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe	30

C:\Users\Admin\AppData\Local\Temp\ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe
"C:\Users\Admin\AppData\Local\Temp\ef0dc15dd3024d4b0e52446d9fa777b6e3e0236bf16c3a35290ce37200b74bfe.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1b8eff040ec493e32f7106cae09693

SHA1
e1c318ce841e9915e42e00295973481505b1cfb5

SHA256
c05a6eb79d49fde29f1d7be20562f51f2caf730adb947c2f64a7fd63ba874801

SHA512
1cdc2a88fdb273e7f08488edcdb3fa955a6e4b8007e2569a69212fab6c3a628a229875fb56a30f7ea4f08242314e143aace9c95126094b3650bda1c2455eacd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
380220a39e689d191890cd1db7bc5a43

SHA1
f7c7a76dd77543a503a73804148c57e931a408c2

SHA256
8228464c4d38c3a1fd781a4aa822279c885cd3c0bc3b1233f40816c215db5b88

SHA512
478fca16ad7d5fe625e75ec227e4719563a0c9259ec425d4493e24d8c99e1bfc86b5f260a362f08ea13a512014cf6d690cf6e353d4872ce81f4f62b924ebffc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29983a04e1eca585754ad320a401dcfb

SHA1
1804fe88938ee5edbfb2d20eaf0a9067b6a6a8b9

SHA256
50a679953ec968773c296f5d1d83797b2922a4ccd7ce63d0a7f46b01ede77a87

SHA512
443d9ef9d60af19ee4af2e37be46a2523387f64a7d21cb54473145ead254f1e57ca597fc841cd527dfe82811f0444b8ab32b36ed12f4889e6379007ff0c4b197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1372097fad45e7edaff268ebe1eb454

SHA1
be713b6fc5b29cfc77297ab48fe686773a6e68ae

SHA256
076045cef52b4db5ba8bc17ce89409f2e4930c7d65e45e6c0c5bc5399442687a

SHA512
3e1f10eed8936d76783e11a30ef8f7f966f127ad116e884159e95b60c24e4b9a439b5d2bfc558137f24086779bc2eff396a04a3910aa53c739c4a7941a4b1f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\search[3].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6C3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC734.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBEDE.tmp

Filesize
29KB

MD5
097c7af47085ca4da042760c4cbd1fd5

SHA1
e8b71cb2ed6b40c71e08e5ee108e26a50e036b29

SHA256
433b94b9ee3d1ec72a5a2195e8269de906b9b5867c7e7c7ea9db642ac895559a

SHA512
58e5fa8e2ad0e137308bbf3f2e90279f7920aa3ba69a73b3d3384adf5ee1762633a7b8402c0ba46e39aa9026f147678cdf15e74a0d36f127888c9c52cd018d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
5a686689a73aa8291b08f40934d2b59b

SHA1
df69495557f5b3a2030a392f715a6cfffea8dbbf

SHA256
4ffb34e2358e603ad6c004dcff2d6a61f886f53e4afd8c6d7572a8876409e69a

SHA512
e0077e82eaeb19245f53931b2bbe422fba8063bf3411fbb575c2f5b2ffde103eedf924352ac0a944587b456752e655667f42f565c9294e636418357fe1b8cd48

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
b983e4446c3c99da09391f3d3d2a8605

SHA1
b87bc641f82dd33630288cc21c685f927f24de52

SHA256
aef59488016ebb328f1969f75caf93cb849d6e3f792e4bead9f1a0df7c5a912c

SHA512
c94666920ef3862c514a914a4af542da4f926cae1a87282d12f87c677014b4e2784925d3ec89ec91ac5150e528b736ab484cd290ca6041a2ad20870ac311b9ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\zjg9emFVcj.log

Filesize
320B

MD5
3345458b44b14272550c83f076ab3b85

SHA1
f1b0107a36ed692400317f6108c23cf7a3d4b643

SHA256
b2f78a07cab1dd77fa06d32fcdc9ffc3c0b6eb9bbb28ac9e766f32e974560cc9

SHA512
5d120370b753b718da627b829913ffce988fd38ab8962e8628fa02dbcad58e7b00f5c91482348b69d1f46612a5e906fbd1efddbeadc2d22881fd42965ab175bb

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1968-16-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1968-354-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-281-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-76-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-60-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-9-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1968-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-36-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-69-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-17-0x00000000001B0000-0x00000000001B8000-memory.dmp

Filesize
32KB

Download
memory/1968-71-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1968-41-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/2376-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-82-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-282-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2376-355-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads