Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
08-12-2024 02:19
General
-
Target
cd224a41c6b64387d30682998df775798742e54ade7e3b15a1a7915201c5f68aN.exe
-
Size
29KB
-
MD5
0644311fdf17521954f7a2a9d8d91a00
-
SHA1
64645c33a1a950415debec332cf842d42b5d6ff0
-
SHA256
cd224a41c6b64387d30682998df775798742e54ade7e3b15a1a7915201c5f68a
-
SHA512
a9426ffc77dfe402182781a6766039f9808a66dcc94cd5800c3a626c364819fd137198d24620601617e2de0fc0abfacd53c5a1e5b6491855a70de563640935d5
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/9:AEwVs+0jNDY1qi/ql
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd224a41c6b64387d30682998df775798742e54ade7e3b15a1a7915201c5f68aN.exe"C:\Users\Admin\AppData\Local\Temp\cd224a41c6b64387d30682998df775798742e54ade7e3b15a1a7915201c5f68aN.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD57198f05348dbbced6b4a12b04b44f39a
SHA1a5df068d90cda9749ab7129e457b0c2d8f0111ec
SHA2560d5ffaa846bab0e47a23200cbd334cab6eeff85bd2f825521cc19f496d41fc19
SHA512e2e418267fa1c59bec9c270c8d6fefd4f505c07c4d10587f2dfdbc1f07d03a0dc817719774346a5c6bacf4c8ebea14e0a90219ea645769972fb9d3d08f6f8321
-
Filesize
352B
MD56e302928b47094c4b16522a1fc44dd25
SHA16926187e4e219df2af76215562679067746e63ce
SHA256fe631866b14f5daf060643a33ffbfdb6af8f83e8e61e28d6b017311988161c3a
SHA512530d2695b374ba43aef7ab323340945cb5873c459faaeb0507b144593f0c5d0a80d7c882cc5c3dfa9cf77dd554fbe4afbd975ebc759a54b5362fefa2b87b03c1
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB