Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10-12-2024 22:49
General
-
Target
5f7be5135034aaeb85476cc4152d8f69e4cea73a2083b02eed44d3dc445ea690.exe
-
Size
29KB
-
MD5
619e0ec0357fe8d74af1381b8debcb01
-
SHA1
1b8302fa71471644057c470aa1cd79db5fdaafaa
-
SHA256
5f7be5135034aaeb85476cc4152d8f69e4cea73a2083b02eed44d3dc445ea690
-
SHA512
c49c9ec19b153b8957fef5bf08670a0f15db1ff83b7549b6b955424637052a37d1163f9eb380791fc56001fd0139ac741a18d4ce4c9aca6872a31061e4d96ace
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/YO:AEwVs+0jNDY1qi/qJ
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f7be5135034aaeb85476cc4152d8f69e4cea73a2083b02eed44d3dc445ea690.exe"C:\Users\Admin\AppData\Local\Temp\5f7be5135034aaeb85476cc4152d8f69e4cea73a2083b02eed44d3dc445ea690.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320B
MD526c890809b966320044b9200c32d9ded
SHA10cd586408b915f39494f1aa97dbd4cfdcc26fa26
SHA256812c153bc25a4878c4b8f73be9caa2497d722dcdddccadd6a0e4942e71f1b715
SHA5127bd755af4f0d4c4420a7b534426b1400227130d5e60a018060e354d983505710452681bcb53d427b7ce59aebd1d7b96942729905c24365ea5dd57db7bf1846bd
-
Filesize
29KB
MD5ba7573c04d389e6662549900e97af713
SHA18a5fcc9e7bbbac45dcfffdfdb587d29eafd00453
SHA256cd69cb2d4ac898f630aaf0b953ca7d4193b99da15d3dde581137f5cd52e8eb1a
SHA51261a866589849295036c8c11046c9bc3c2c3a412125ceda11f7fde8d993281e707677fcb0ee0ae0bd0a0cc6c4d198bab5ff5ec67bbda79495e990dd0af39c518d
-
Filesize
352B
MD5db1f5417d7e775fe5d910dfc2d4dfc2b
SHA1477eff6c20c8100283c304ad62f8a441c99161c3
SHA2563311983fc9540f8ae134e6c243fcb19c00e385f02162c511d93afe3f1e9f76a0
SHA5122c5c9ac047cf280e98413bc604459a5b6e9395fa69236e5ef25abacdb34bcd2fa492d1630c79729a07c216f18d6a09487565885f67e052dd19f82ba241c410e2
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB