Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 09:56
General
-
Target
ce9e9a3a72321834ca9f5595e9a78ffa989072d8b950c46bcf203148fcad3e44N.exe
-
Size
29KB
-
MD5
b3a57d4732f07f997f16878131ff3e10
-
SHA1
b5e34292dfcf599d3c827b27c095d43f7845df45
-
SHA256
ce9e9a3a72321834ca9f5595e9a78ffa989072d8b950c46bcf203148fcad3e44
-
SHA512
cc0e5b3c941c622f36ccf8366ef2a0556f70da20595083d0e5994c474d71e0bb156f458eea9180101af1ec838051386b19a201d94a75579c23bb1f045ebc423d
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/n:AEwVs+0jNDY1qi/qP
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce9e9a3a72321834ca9f5595e9a78ffa989072d8b950c46bcf203148fcad3e44N.exe"C:\Users\Admin\AppData\Local\Temp\ce9e9a3a72321834ca9f5595e9a78ffa989072d8b950c46bcf203148fcad3e44N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD57f4ecda40a7373ea22cb0310e4287507
SHA1a3135ae74991f110c65c9bf050665441879c61ad
SHA256e2e43333a881aef93f1338847e0aedf49a2b01196b94b9a563a8d839ac885054
SHA512ee388008e0aaac6cfe012b807386c1d3e30cf9e49a89ec9378991707e5ed09d7c91374c4736ed25c19494a1aa4454d11842afff57bad2804416eeb8ff0cf3d56
-
Filesize
386B
MD566d4f9886ab61a9143e398f6e53841cd
SHA1844047a6a9564e06b375abe34b585e5b95dd11fd
SHA2567a174b790f27f75582175d900aa6e74403933eee634c66989417ed7d61f78a3d
SHA5123ffb451193c188a60a5abe93ec06572740e84f969e730eba4c8dbd5bf58f1a68a513c13ff3638ea49b6c53959b7a953fbdfcf7177f59fbd802ecbbf246cfb0ad
-
Filesize
352B
MD59d9ba8c3ebebb284a483d70a7cc03dd2
SHA1d0e302215aaa2a1c862b8b73b8c7f82574735277
SHA2563ffce0e89fe8129d5678fb57324b7652377447783118610dd1f238a9e34a9ec9
SHA51207da963a20e1dae5ecbc07402340c2ca80f74c87af864a19e459ed349b0bcdb631dfd06d0b6c782d967a94824ddaabf6a066d7040d0b3057acd124864c3f2c62
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB