Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 19:43
General
-
Target
2e32e046fbd4de5487a019130966a571693be060b5fa76f72f18f2354c79a1b2N.exe
-
Size
29KB
-
MD5
3a2eb331baf84b450f09f1f0cbb8c840
-
SHA1
198e3144626fd3189024323f2bf6092fa1b9a154
-
SHA256
2e32e046fbd4de5487a019130966a571693be060b5fa76f72f18f2354c79a1b2
-
SHA512
834f42cf76ba0fdc5dc22dab3e1730a73ec5487a7d9f9051cb7604570474ab1d41d933d63116840642bb3ccd4fca993f3ded68aa33684536a6c1b611d66db98c
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/w:AEwVs+0jNDY1qi/qY
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e32e046fbd4de5487a019130966a571693be060b5fa76f72f18f2354c79a1b2N.exe"C:\Users\Admin\AppData\Local\Temp\2e32e046fbd4de5487a019130966a571693be060b5fa76f72f18f2354c79a1b2N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD53c1a11987bda6a72bcf1c0b3916950fe
SHA179bbd16b9b942418cd4a1eb3bf6f9cb9253351fd
SHA256a216311de73f4d1d32012806eda9cf8ed1ed12863eb959c50352db369dc2e089
SHA5126bfe0b0eedde2a274a802edc43f7432978b162257d2b79f6b18dbfaedd1d3adf7997dfe245ec608561868f3500fbfb794276c2f3049e7bc0c961dbaa635e9667
-
Filesize
352B
MD53440422938194a2de7d98d99710c08b7
SHA100a371b06ce137b678af298305cf14dcce4fcc12
SHA25655fef3828b17d54cc4a3755e1784b0f2258d0053bd2730cb8384f4174b754c39
SHA51217c9a20a93e1a70bb62c7bd4d1b9fe40d8491c51294c3a5e78af00308178371a1cb49002b7fc5538f45a81423f1f15b59eef6b37eb2813b229b6e580b4eb01e4
-
Filesize
352B
MD5b22d4ec3641e60e8c28e42bab9d969ae
SHA1fe3edd3f8c46bca8e35d78c23ffcb53330d32f14
SHA2567a58052b6c290fa11f09bd5f9eab838753fcbc59c04786675827a31e7f58d748
SHA51286053ead993b0a473451541f6b202b228b4aefd951f3eb8ff332f2d243fe2dc5306f48d3616920520d52bc1e00820d656009d244af778ebb50288c0cb7af10ea
-
Filesize
320B
MD583972c717430beffe6aac4651e1bebd7
SHA16eabdeddb023991e9afa83b9e70030028c973166
SHA25607f83de00ecd246129e0ab7afb6df708f5dbcad2c5d57cd58dc6f09bea51d777
SHA51245f29e9fe0a86f3d89df4b7e0cc63649f90bdf6ffa65c3a77689a6c8e5906fce291ae5ceb8c8e80188b02c0c2f4edfecd6fbd7de06214697f1dfa1523512e140
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB