Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10-12-2024 07:00
General
-
Target
805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe
-
Size
29KB
-
MD5
0d6e2e1b3d27c16a9d99341ad3348102
-
SHA1
298ef223dbdd68b949c50db722256440cb57510e
-
SHA256
805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705
-
SHA512
80abaa6390ad5dceea59b194dda691d2efd90f33195105674837bb9b03c9eca81347ce8f8697b6f39b634aef076c512c5f1788af312c2f73fdacaf97d20d67f5
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9//:AEwVs+0jNDY1qi/qn
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe"C:\Users\Admin\AppData\Local\Temp\805b36acf6767168ef4f337591a71230106bb368f524ded8ba45e9ac66b64705.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD59a6fba1803ff6c93434f0a6881d9c963
SHA1c81bc445738b1dc03d486f8d57008f34049f00e6
SHA256752feabd90a991f7b9c337e0650e92e98e9543f06b89f3004e70123fb3f6fb3b
SHA512edd90cfacdcb50bd91dbb2a6d7682c183c508d3211480cbfedf265bdc57a849f983987f1cac866f6064a21cc6a2fadf2096a87f93b73405c22f48eb36255e638
-
Filesize
315B
MD514b82aec966e8e370a28053db081f4e9
SHA1a0f30ebbdb4c69947d3bd41fa63ec4929dddd649
SHA256202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
SHA512ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
320B
MD5d9d237c4cb8807add24326cca58d74ce
SHA1f42707015d1e7137615d7391c3f1e42123c5efcf
SHA2561e0382105382d985fd8da80cb5b1ca99815735f743c63b3028aa2ae941655a6c
SHA512684fe1ecc3e0f345d4a67355cdb907336644108ec43051f806257d48fcb24d793d3a748570d89dbe68fa4d81282a923f9f5bc43ea4df91acf63768860be7fddf
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
29KB
MD5e13db50c2ed2fe5295618c063b356fa2
SHA1ae8ababb42fa6133c4393bc666f7f40659637ce2
SHA2564e08a47a6b7770ef7c99dde7f3ba2d7e6632eb4535ab258bcbeb6f8c6774d275
SHA512407df3b334e2f1a4f02d8058b922018831ac2427d04639d03cd0deff8109bfce63ba2b56cb5a0e89f3a4f129bee82efca837a2c8aec57d76b81b81aa1763fd3b
-
Filesize
352B
MD58361cdb863d32aeb9d425c34d9748ca3
SHA14751e2c7b4382376f2debd6859450890b5d015da
SHA2563347f310531f059592cf712adf38214084b3da2cf3f3b2397be22f0eb46845bd
SHA51253f8e510f931dc31ce5e2e7e41480a3ecf4f32f64fbe1950980e89371053bdb1119acddf77f1512f94cef822aace6b1fa2652c05a35d9ac3a5e04a3ac6b81f69
-
Filesize
352B
MD5d1360449c089e24ab34f90ab15621a56
SHA1fc4aede97fb9246bea5a9cef5730224a9c3d7848
SHA2562c44e60a2080bc6fdba07e0dcf77c1feb54b0c7681d2fb02e0dc97617d9aa181
SHA5125d813e5745c92db86484b0f67f51d3dbaa8f4cfc7ebfc076544ac260518e1078c3297d91a1f20c88e6ee0470b1fd7408899d79cd82e65feaf9a85b81e81fff53
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB