mydoom | 0e49b327e35f3e2c1328649d0752fa3fbe79b0aee1a875fbf36306a9fb587bd9

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
Size

195KB
MD5

dec558ed05a4e33c7f71769d3832f107
SHA1

073eb35eba241a631f900a67d10d794b25eeb28c
SHA256

0e49b327e35f3e2c1328649d0752fa3fbe79b0aee1a875fbf36306a9fb587bd9
SHA512

f7107ae2e184117c66cd3c63096f49852b6e578e51565ac3fe2a25a56a45901ce48df292aa7414f76df4dccdfdfcb5f48f103b29458ae7a1bf6867ea87dce91d
SSDEEP

6144:Y1c6jL5pvnBYCLbb8Q5AGKgICNILqDe6x:Y1c6jL5pKCfZuyIQeg

Score

10^/10

mydoom discovery evasion persistence worm

Malware Config

Signatures

Detects MyDoom family 1 IoCs

resource	yara_rule
behavioral1/memory/1868-25-0x0000000000330000-0x0000000000342000-memory.dmp	family_mydoom

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\msmgs.exe = "C:\\Windows\\system32\\msmgs.exe:*:Enabled:Explorer"	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2724	retinascan.exe

Loads dropped DLL 5 IoCs

pid	Process
1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
2720	WerFault.exe
2720	WerFault.exe
2720	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Messenger Gateway = "C:\\Windows\\system32\\msmgs.exe"	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msmgs.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\msmgs.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\KB915120.log	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\retinascan.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\program files\kazaa lite k++\my shared folder\Adobe Acrobat Reader keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\Ashampoo PowerUp v3.10.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Anti-Trojan Elite v4.01.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Sophos antivirus updater bypass.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Password Cracker.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Error Doctor 2008.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite\my shared folder\Sophos antivirus updater bypass.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Absolute Video Converter 3.07.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\emule\incoming\Acker DVD Ripper 2008.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Download Boost 2.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\TCN ISO cable modem hacking tools.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Adobe Soundbooth CS3.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\Password Cracker.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Super Utilities Pro 2008 8.0.1980.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\SuperRam 5.1.28.2008.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Shadow Security Scanner 10 Gold.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\SuperRam 5.1.28.2008.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\CleanMyPC Registry Cleaner v4.02.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\TCN ISO cable modem hacking tools.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\emule\incoming\ProRat 2.0 Special Edition.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Download Boost 2.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\BitDefender AntiVirus 2008 Keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\VmWare ESX GSX server keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\Microsoft Visual C++ KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Absolute Video Converter 3.07.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\Microsoft Visual Basic KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Mirc Keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Absolute Video Converter 3.07.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Anti-Trojan Elite v4.01.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\VMware Workstation 6 Windows keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa\my shared folder\Canvas Security Framework 2008 LiMiTeD with 50 0day.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Adobe Acrobat Reader keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Microsoft Visual Studio KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Sophos antivirus updater bypass.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\CleanMyPC Registry Cleaner v4.02.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Hotmail spammer bot.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Tarantula Full version CRACKED by RaZoR.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\Daemon Tools Pro 4.10.218.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Windows 2003 Advanced Server KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Email Spider.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Super Utilities Pro 2008 8.0.1980.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Wow Glider incl serial.SFX.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\YZdock Machintos osX like toolbar for windows.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\AOL Password Cracker.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Google ADsense clicking bot.SFX.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\AOL Password Cracker.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\TCN ISO cable modem hacking tools.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Email Spider.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Adobe Acrobat Reader keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\kazaa lite k++\my shared folder\Microsoft Visual Basic KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\Norton Anti-Virus 2008 Enterprise Crack.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\Download Boost 2.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\PC Secuity Tweaker 7.6.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Daemon Tools Pro 4.10.218.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\morpheus\my shared folder\Super Utilities Pro 2008 8.0.1980.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Windows 2003 Advanced Server KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\Youtube Music Downloader 1.0.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\CleanMyPC Registry Cleaner v4.02.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\limewire\shared\Adobe Acrobat Reader keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\Google ADsense clicking bot.SFX.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\winmx\shared\BitDefender AntiVirus 2008 Keygen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\icq\shared folder\DivX 5.0 Pro KeyGen.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\grokster\my grokster\CleanMyPC Registry Cleaner v4.02.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
File created	C:\program files\tesla\files\Sophos antivirus updater bypass.exe	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2724	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retinascan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "1"	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "no"	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 2220 wrote to memory of 1868	2220	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	30
PID 1868 wrote to memory of 2724	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2724	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2724	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	31
PID 1868 wrote to memory of 2724	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	31
PID 2724 wrote to memory of 2720	2724	retinascan.exe	32
PID 2724 wrote to memory of 2720	2724	retinascan.exe	32
PID 2724 wrote to memory of 2720	2724	retinascan.exe	32
PID 2724 wrote to memory of 2720	2724	retinascan.exe	32
PID 1868 wrote to memory of 2540	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	33
PID 1868 wrote to memory of 2540	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	33
PID 1868 wrote to memory of 2540	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	33
PID 1868 wrote to memory of 2540	1868	dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\dec558ed05a4e33c7f71769d3832f107_JaffaCakes118.exe
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\retinascan.exe
    "C:\Windows\system32\retinascan.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 88
      4⤵
      Loads dropped DLL
      Program crash
      PID:2720
- - C:\Windows\SysWOW64\notepad.exe
    notepad C:\Users\Admin\AppData\Local\Temp\Message
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Message

Filesize
4KB

MD5
f87af49e8598bf7e127f21c9d04402a5

SHA1
1457d2ea368565224faa346aad1e37bce68a51de

SHA256
0ac03de88d8d313353ca2c9d9d1516e3742315017f55dd7168c4d4b3516d8f64

SHA512
3843f243d7e997ecbf09a5abdd387c12fcefde8bb548a1213235b133eec8d0e5c159e323b999749c7c563315ed1237284f4eadb0ad6e6b7daa406d1e488bf05f

Download Submit
\Windows\SysWOW64\retinascan.exe

Filesize
53KB

MD5
8dff6ed5e52b67460e5ce81e9be4121d

SHA1
958a03f9ecc0ccc3695257b388838ac75d631f9d

SHA256
202cbe47018c1ef372496552697e650126411943061ccd1008b6faa28a02c3bb

SHA512
a65eba95bfa01bd974ed05048936622bfa72e566e4befabf4a6a754d33c54f2cc035d311ef985bda5d4c613e24e6fbe616d18bdc20d52bccc86e5552d1716446

Download Submit
memory/1868-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-4-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-12-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-7-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-2-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-13-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-25-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/1868-30-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/1868-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-38-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-46-0x0000000000330000-0x0000000000342000-memory.dmp

Filesize
72KB

Download
memory/1868-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1868-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2724-32-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads