Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 18:27
General
-
Target
00c0460a94361f088babcd96269407a7181609b3824f810743391d3355c60f56N.exe
-
Size
29KB
-
MD5
56801efa571aeb5c0479ce92f72f0cb0
-
SHA1
21874b6bb13a810b0ccce435e1b9c074de83c164
-
SHA256
00c0460a94361f088babcd96269407a7181609b3824f810743391d3355c60f56
-
SHA512
c251793630aab39f0f3c3a2f1854179e214a1418f5412b668538de2f10f12a4778b39e8c5b3c1b2e026678b4400052b0a0a16347ed71788c4c2191f5ac7a7f20
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//7:AEwVs+0jNDY1qi/qn7
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00c0460a94361f088babcd96269407a7181609b3824f810743391d3355c60f56N.exe"C:\Users\Admin\AppData\Local\Temp\00c0460a94361f088babcd96269407a7181609b3824f810743391d3355c60f56N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58522dcebc0a24bbc81c531e35e77b468
SHA1d3e31e6334fbfac6a59983753738ad23c7b5033b
SHA256364af21ae243ff67c9a9a05906c00ca6b383315b2c824bbfcf3e9b46fc222956
SHA5126c8b492afbb75f374ddf28acc575cd274688cc1917650d6f8da15a2486c4836d66d0b473e17377cc294170f0cd055874287bb207b0d21ca01c4d0acc5dd58eb6
-
Filesize
352B
MD516f815eca4410b3d268d027d3d6fdf62
SHA1123ce95692feedfee170fc76b7bdb5f10c393c64
SHA256b57f2504bdf31b297c765b7c62dd7d8cd5c532466c934600231548254daa6a84
SHA512b6be495756754fa7b2947aae5f440bed592ccc0d852c6802364c984e1df8af08ab547c198da597b65fb819bf21081fbed4c2135835a3e393f8d5fcf5dddab579
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB