Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 06:56
General
-
Target
805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe
-
Size
29KB
-
MD5
0d6e2e1b3d27c16a9d99341ad3348102
-
SHA1
298ef223dbdd68b949c50db722256440cb57510e
-
SHA256
805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705
-
SHA512
80abaa6390ad5dceea59b194dda691d2efd90f33195105674837bb9b03c9eca81347ce8f8697b6f39b634aef076c512c5f1788af312c2f73fdacaf97d20d67f5
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//:AEwVs+0jNDY1qi/qn
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe"C:\Users\Admin\AppData\Local\Temp\805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320B
MD5e94f99b74f62b3acb4434fc2877fd5d6
SHA124570647d1deb83d529821a8ad78de02d6d6e54c
SHA25601bceab9edccbfe5d8553773562365f653e5f2898ccf7c696226de4c25c257e8
SHA5127bfe3c8da5f74afc442e5356c5f1043d746666f4d9fc7f3924c3632dc848968cdc489a64ea5c3769fec9957979f12c2f6b0b4de0b690b50957b032b952047dfb
-
Filesize
29KB
MD500c90e26a4fb739ba7533233258b6d21
SHA1bad7026eac376e8c1b722a59851d9c4199a606b4
SHA2569215047a752b859fdd88cdba075dae53018b033e5666a8b8d7b235cff321695f
SHA51201fbee2e4d841402dcfce20de1dc21fe8c4eb3dd0e91710c0e830192df791faf4cc3e2686461cf43f41b989103dc4443628c06cb99c85c4daa17b6c5724ab354
-
Filesize
352B
MD58a595dcc07115c865ced43aea6fbcb46
SHA1137aef76a621ca185d506a60501856fa7711266e
SHA256216cf7aa1f887aa1ad0709d77f2b4f66252e889e89ddb6675d3fdc965cf1c147
SHA5128def047f10c64da7ed52575102611194f9e8e03aefbce44ae684a5680daaddb3272f31f991e613667c36d3e6335dbd3745a7ab37fee99bdfaa3f201d213b20f7
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB