Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-12-2024 20:59
General
-
Target
5203c0b9196b3c1c200e04261a7eadcf7a2876fa1424e3b8375467571e2aaf8fN.exe
-
Size
29KB
-
MD5
eaa9c12147870a2458289acd0a0a7860
-
SHA1
5461e7b0e2a9808b8c4ffec5c64b4a1e8a83f568
-
SHA256
5203c0b9196b3c1c200e04261a7eadcf7a2876fa1424e3b8375467571e2aaf8f
-
SHA512
cb1f67d0f0c3838e19afc6e09c5f6573606a225f33178538ba907f84743587a925e7e1340ae18841c828b76740f6318b072ea756b0a466a9c1936ae0a39b2034
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/5:AEwVs+0jNDY1qi/qR
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5203c0b9196b3c1c200e04261a7eadcf7a2876fa1424e3b8375467571e2aaf8fN.exe"C:\Users\Admin\AppData\Local\Temp\5203c0b9196b3c1c200e04261a7eadcf7a2876fa1424e3b8375467571e2aaf8fN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD52c454fc5a953f5203975616c3b0031bd
SHA1d3bc31723b55b71bf2d1d3361801f1207da478d1
SHA25616015cdc54395d6921f6123a4ede3764302667cc69e053c220c166dd9cac4350
SHA51252512a2bba4be5b0e6a45e583bcc3a780f836692be7ba8f691845e8487227fa9614a9f39239e6d87fc1ac20f0660e6755b2ab84ecf9249ba1bde92abe49ffaf7
-
Filesize
352B
MD56618f14ec7de9ee3f176d8f16a0648c1
SHA187da1bcbc0e6d11896b030e31d0f29263e5fa237
SHA2560d55e099c69dd5b128335b01996d8f7aa39a64840f242d49f4e6d7b5f754e505
SHA51265d6318226b3ecb75677db80be68566b3b7ea4b1a6723f5cf88c5ed104554223c420eea2e763acec2a7a0a31020e9abaf4de30b032f445aeb560fabb41ffe956
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB