Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2024 19:30

General

  • Target

    072e8fd4749dd728b0458d560a2d1706135bd1fbf8e4ee7d69b38d1dc880ad8b.exe

  • Size

    29KB

  • MD5

    0c358b4d6028153bf5f1904ba31d1f51

  • SHA1

    a62d1ee678d5f59d49e8b8bd95b832f529c35dea

  • SHA256

    072e8fd4749dd728b0458d560a2d1706135bd1fbf8e4ee7d69b38d1dc880ad8b

  • SHA512

    60416fa30b187b12c4a07d7248b469224a78789059dfcf2d328818e99dd85a71237444697a7a9260643c3a771cb94b2c01c3af5d599adf829d550a2dcd6e530c

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/zS:AEwVs+0jNDY1qi/qu

Malware Config

Signatures

  • Detects MyDoom family 8 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\072e8fd4749dd728b0458d560a2d1706135bd1fbf8e4ee7d69b38d1dc880ad8b.exe
    "C:\Users\Admin\AppData\Local\Temp\072e8fd4749dd728b0458d560a2d1706135bd1fbf8e4ee7d69b38d1dc880ad8b.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bef95f4ac30138222e69b97d17b75a93

    SHA1

    e494588b072641361aebc9f8851de83efd96dcd4

    SHA256

    c587bfde872b2a5e05ac4375fd86ec86a9883100670ed902bdc4eab1b8fd98d0

    SHA512

    61511ad2a31ecddc7750c6c1a00a0cdb9ff917e42bac503e4609830c976fe5ba2927361762a5215501e9f98b91455e485ee36fdccc9730e1151a76c95fcd2740

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    772a4b6dccc0bb8d96a3fe3902e5163b

    SHA1

    663ae863eff1a92486e06b685048a6a4db0f2f52

    SHA256

    3b9f363d2cab1c8edf54ecf642a7f177388e7b7cabb60346565e57991af1ed6a

    SHA512

    3acc6c4f7dfa37080654bb673d5d2f9853de8f24f6e3b6a4e45c01b8d4d1b47ae93e469df968a1273be5412650d7be76d688e9fb505b7af8e5d1a46e21b102fe

  • C:\Users\Admin\AppData\Local\Temp\Cab5693.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar56E4.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmp5390.tmp

    Filesize

    29KB

    MD5

    5e4648569aff8b5e891923873990f392

    SHA1

    ce2c976d8e0f69160727b6efd9282f525eee4560

    SHA256

    943dd4b4bb5f9afc6e31a17d80388bed98578cf9c08665e278b1ff2dea189238

    SHA512

    59274d6dd38484e32abb7fda944457333790d0dd65c31fc8ba97d9126b582592b30397692b7d2e0a9508daac59c902ed9b3d84d98cad5314d1355dd9ced835a3

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    985c73cf8ec045bb65268c1fa3d9ad45

    SHA1

    5c402e60d8e7a1e3701b1b9e2b877a67025ce14e

    SHA256

    3691be7d8d9e6590a1eb1da4024a656ae70c7979c0b566f967aaaca6ab59e960

    SHA512

    89ae0f4b06172ae8ca932484476ffd2a34c298646a39012589afe9c891b2c18b5868d3c28c1e876cc0a06f26461414ca10985dbbfb553d252889b4de11675f42

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    352B

    MD5

    03b7246cde9bf4824ab4080e7715b8ac

    SHA1

    67f81912af8a204fe8546b4f43845f8628bc5a91

    SHA256

    aa90adf17c1f56a6bd5dee6023a40c658a7b11aabbd4de1b49729bf24f793d57

    SHA512

    b09bdc21bd0a2b10477b0af540b0897afae10913a963c61a66bc24dfde2078ef2d51a7be945260d8c8ca1af7df8e3cdbf147e374bf111cfadbf1070fa43c7432

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1620-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-9-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1620-17-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-73-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-92-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-87-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-44-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-85-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-18-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1620-4-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1620-69-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/1620-75-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2656-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-74-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-76-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-81-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-45-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-86-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-43-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-88-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-93-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-31-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2656-11-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB