Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-12-2024 23:21
General
-
Target
[email protected] .exe
-
Size
28KB
-
MD5
c5c0377e70d400bc42cc0d10655d8919
-
SHA1
2692dcb2b970168b6049d1772e30d64911a582e3
-
SHA256
8f6535687f9a3f04500685c49fc32e2e36bbb3d7952ff3f3f7adb58d841f2045
-
SHA512
7be705adbea072fdb2deeefa81e29f094d961f4c707e177c5bed9ee1f6153ea4694c610193f37f94a25c4017a5100fbc17f620518f0aa03df7430f4788d37e05
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNp95:Dv8IRRdsxq1DjJcqfy5
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected] .exe"C:\Users\Admin\AppData\Local\Temp\[email protected] .exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD571efc4c97c7f38ac78c1dd9e02c5cd6a
SHA1764d46cda82ac50162a6fb289bdd9d4e8c2a9a85
SHA256ea2a367b8235ed6186b8d23379bedc1a17f172d1105979fdd58bfbbd0138e523
SHA512ce42c285862f493641b00f4809dd2388ffdd252f0eb5cc7bc2974e7d96b0bf5fbbf97aaf35c7c076ac2b1e9b6fec23632d345105ac7a0372cc5e58a6e914affc
-
Filesize
1KB
MD532605b005c1b907e354c3bf67458ae2f
SHA10f9b0154a7000ff665b625a102d6be44f7f775da
SHA2562b3c80c298b963e5f3a20939e1738cb2858ba95fe6ddfe24fedb05c332cf5521
SHA5125b5a48107595ebd831a27a46723e52840091674f08064f587d4b90533b469b0b4b2c2646dc9063b7bd0e27f7956211894faf7e15c3d8275012dafa7233fdf19b
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB