mydoom | 79319947afabf0135caa4c3364f3b823acfaf7cbf51523685c75c4ae5fb0439f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da6ca98104cde085278429aad5565267_JaffaCakes118.exe
Size

28KB
MD5

da6ca98104cde085278429aad5565267
SHA1

4f1357b1031f43cd652fb156a3fae7c153caf240
SHA256

79319947afabf0135caa4c3364f3b823acfaf7cbf51523685c75c4ae5fb0439f
SHA512

eeb6214d79864bc287a28ccd26d408cc3d13dd3507caab4cb539de219e6d06a1ae613e998305b024f6863885b6f852b5826f099ab95d71b9f7f15e4b9d7435d7
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNKV2k:Dv8IRRdsxq1DjJcqf32k

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/2440-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-39-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-124-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-216-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-218-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-228-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-276-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2440-320-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1196	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	da6ca98104cde085278429aad5565267_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2440-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000a000000023b66-4.dat	upx
behavioral2/memory/1196-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-39-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d0000000219e5-53.dat	upx
behavioral2/memory/2440-124-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-125-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-216-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-217-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-218-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-219-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1196-224-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-228-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-229-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-276-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-277-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2440-320-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1196-321-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	da6ca98104cde085278429aad5565267_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	da6ca98104cde085278429aad5565267_JaffaCakes118.exe
File created	C:\Windows\java.exe	da6ca98104cde085278429aad5565267_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da6ca98104cde085278429aad5565267_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 1196	2440	da6ca98104cde085278429aad5565267_JaffaCakes118.exe	83
PID 2440 wrote to memory of 1196	2440	da6ca98104cde085278429aad5565267_JaffaCakes118.exe	83
PID 2440 wrote to memory of 1196	2440	da6ca98104cde085278429aad5565267_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\da6ca98104cde085278429aad5565267_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\da6ca98104cde085278429aad5565267_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMGLWGAG\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V4KZV1MD\DEOXYKX6.htm

Filesize
153KB

MD5
5dfed2abba51e07494d2447eef4ff09c

SHA1
2741ffa3b44ce8ab17e8f34bf52eb6f16563ed06

SHA256
2750d3ac847ef30fd070248e9b90643aa3776c8533ec77ca0c679c7729b6ac22

SHA512
8eb7e03ed35ca99ef5c95165dbff2c6aa22256331d371baf48b97078a283dddd0be32ae909e7f516c3efdb75a1863020e6d686460f91af6742fedac68f6c85ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V4KZV1MD\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V4KZV1MD\search[5].htm

Filesize
132KB

MD5
be817be2686e8963e3f4c6372da19b7b

SHA1
0c383d82b39dde2244729e268bbc9210e05e9e57

SHA256
3f9816329e9dac7cbd4d0188e80f2d01c891401060548e2c2a0ec8f849601082

SHA512
68859ba3f7ccd2d23df8b0affad8273ca0a348e98d72f39076b6a20b36d54fba9b86c10f1e957fccbd950b5c191390a63aa863f33e94a1916e82f627efc14899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\default[4].htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\search[1].htm

Filesize
119KB

MD5
8c2f0d4c5863608a769cbf567be7dd2b

SHA1
c51e10ba3a740054f42468b88d0342fc09045ef4

SHA256
d21cb4b431e041e6376722e690b2561a11052c83d1dbbed3086c394342d59045

SHA512
8d4fd63f43f11acde1001004572b0c17795f93baed9ae400140237fd19689d81fe92efd9e37cf33a78ef55734ef551d85e1f7f6cc38b78211ced1d5b7cdaeceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\search[2].htm

Filesize
155KB

MD5
978364d3b2e076f177c1656eee35a524

SHA1
12398bc6b144ade53d4407733fbeca71c5956509

SHA256
e5cb0dedff53be880ec93d567f6464c4df1a09b2f8487c5643591a74c02eb999

SHA512
81d8121ea65bfd26d960f8c6d4b756e536990ef173ad60935910f50184270b598a7ae9f7fc0ddf65adbd0dc6f56e5f674988d877343b8b4aa3d95a94b1bf7b1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\search[4].htm

Filesize
154KB

MD5
27577f82f2f27de3e14f18e5b216543e

SHA1
9c44b4dbb4376123b07e9358aedb7e2441ba3837

SHA256
2153fe212c1a9ce46bd16e60e9653a317fa8ca687b59aeedaad6c43d7556e16a

SHA512
15ec40b973df1443dd8d6e8cce5d8a1cddcfdab8df22ca4f277987dc9aba1c1e2b5f6cd0ddd9f41f4e2605b9df4eebe2b0fd6829b61cc66a0d2163134b5dcd40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YY018DS9\search[2].htm

Filesize
134KB

MD5
b5567f4a3a318f71f1a396f01fa5e255

SHA1
83ea5d3f0c9f1636f05e2002ed9d96f9e1c056d3

SHA256
2c071647cd16e6584da9dd9a940bd3a3509a883500e8bdf0f1e5c4cbdc754c54

SHA512
5dbde6fa2b5bc5dcba5c68b38152d77357769437cd498ad6dfcb5cd69d5af8cb77203a3a9f6f020a481dc4ca475ed1e2fed4b395283fba9b18c116487ef5736f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB2C3.tmp

Filesize
28KB

MD5
352da18dd8f630ca8f2db10088f0c488

SHA1
81aa181cf6c1e8db071093ecf7f25fa1b3b38216

SHA256
6f6f2fa4e2f31043113c6b825635d6dfa4f1273e36a368907d5685de8d215707

SHA512
1260734b8ff50adee5afcdddc8293c95fb449780ec2b387b1a009de7a70064e492bbcb78efdd6a59f6460c39388c5cc9fd8c0db273ee2ce626b57739f48bf7e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
80ba49aa856d1f37e83dc3bcfd2446d7

SHA1
a16512cc59f49422c04dd0516da5dec32256a800

SHA256
c377d7114c2a342d0c2daec6a16abd1bf871837f3ff053a150e5e7c0ef1147da

SHA512
0823b2b28d99124a6d7672b9972d045e5250194a125dccd4f1575fe3a011793c50a9880407227ac48386971bcacea5ae521ea5c68b31b07539cf9c4920946d9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
4c6296561df0db75a4b49f48177d8a64

SHA1
9d7525eb07063a61fe55741e3bb67ddecefeafc1

SHA256
f6b78bb2e3bce8d20a8bc59c796973c34cf9c91612ec76ee3fb7dc30bb9dd59c

SHA512
4f52c0f6c86bf3b24bde6df4bbe0be54b203da3d3df1684a412019d6211013f9749e9c14341874a5dca139c5e528bfd0d871de8707fb10f2259e5cb4fae61173

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1196-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-277-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-125-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-321-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-217-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-219-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-224-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-229-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1196-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2440-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-228-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-276-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-218-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-216-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-320-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-39-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2440-124-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads