mydoom | b30512117f3670b63ef326a4fa6925ffb39c12d9b48e25cdb440c13a850853f4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Size

28KB
MD5

e8d103525f8f2afa0fa6f080d54641a7
SHA1

346581a08e62362229508427ac0057cd9a3aaba1
SHA256

b30512117f3670b63ef326a4fa6925ffb39c12d9b48e25cdb440c13a850853f4
SHA512

1b9a8aee73e2894a55aed3bbe4566690c1e1cacd4ab35dc713dcdeb1f572a7569e21055037b57addd5cd1e257aa987d725d8bb64774f488ac79a8eefa9066e81
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNu3U:Dv8IRRdsxq1DjJcqfP3U

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 10 IoCs

resource	yara_rule
behavioral1/memory/1048-2-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-9-0x0000000000220000-0x0000000000228000-memory.dmp	family_mydoom
behavioral1/memory/1048-17-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-36-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-60-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-64-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-69-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-76-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-103-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1048-346-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2772	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1048-2-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1048-4-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/files/0x0008000000016de8-7.dat	upx
behavioral1/memory/2772-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-9-0x0000000000220000-0x0000000000228000-memory.dmp	upx
behavioral1/memory/1048-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-25-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-36-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-52.dat	upx
behavioral1/memory/1048-60-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-61-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-64-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-70-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-76-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-77-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-82-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2772-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1048-103-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1048-346-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2772-347-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\java.exe	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
File created	C:\Windows\java.exe	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
File created	C:\Windows\services.exe	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2772	1048	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2772	1048	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2772	1048	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe	30
PID 1048 wrote to memory of 2772	1048	e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e8d103525f8f2afa0fa6f080d54641a7_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
059111cacc3a6cb3d966c980928136bf

SHA1
958e00155041cad367b6a1ece783624f7137f37f

SHA256
be774fd7bbe2184600bd9ba48def17794a86834ba8b0726ae3efb3b617c8bfba

SHA512
8d512cccead4015bb71772ed06383b47f1fdfe59434f772757e3504d8c851a02f12e06dfae404099728911f09822676830782c8806debf77274f521407c3dbb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46c72854fe9446f6627cdc83087de551

SHA1
7acba7450248f14e6931d944c06f490b738f6d5e

SHA256
ea7db9a99268d5250632be8bd13f7d32c6b85ba570db9344ebb5b72fe604299f

SHA512
532c8fc6ff3fc08e0ab2c8f3a027e6cac62c4df04fa524cd8f4420df92f5fb1b86263a8211b77ac0dbe1b03a7355272d5b5bfaf1a3091aedaa0505eab5e17b4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ad336ea0f30e76b7cf2988151a57f6f

SHA1
13a195a4ec1c6a3741549806b73bb39e70ca91aa

SHA256
b36e4ac4d75a6f635fec04c806bad89a7be84254d3e1674a15f640d724be07bf

SHA512
481fae524bedc7a7eb57e4fd7abd66875d85058df243f07614551ca238becf09a208fc44029ed1c5ef9488949f6d46af0f08acb1ffdc37d469faed480582aa93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6d33c5974e530d81f1efd2eae501f07

SHA1
d012d9cde327be7abe120cbf80ce9934de35d67c

SHA256
ab1229a89fcb519ac6c0cce00083db9a419b20b217a300e29bdf8be003edd129

SHA512
bb100dbc0a7ea63ae466cb585e614cb098f14e76530c2c845370df4ec8325b874a2c419f6ebfef0e4271cd1c99fff95aeb6279e2f25cd721ca16ad8c1015b237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c1e09c4bb9d5d4fabbe23b20ecf7319

SHA1
d4816024d8bb93f70be37af8b2c9ca3d40f53d1f

SHA256
bfaed862bd1b36539f94941599b8b60fc02fbda7e9ded79c0b0765627aca529c

SHA512
6a6e57d850d9cb4e5957a97a361175b958060adad1d4b30a00626f8fc62ade1780c624bcc99e34b05d177c73266a29f03e86286dbc806695ca520e350662898c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GP4P3HF\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8C8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA977.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9D99.tmp

Filesize
28KB

MD5
699985bf9208fd5f3d66818267d89870

SHA1
337c09aab80440c54d0637c830a5e3dda4bfaa6f

SHA256
2fd507eaf2b44fbbf1dde93528d087e528dedbc58ad512fef8b6612a1ab666b8

SHA512
6ad4e7f5962b482a4a78045969468c3dbe200300cfdb161bd31c5a2e5ea88c1cd548e22a7ef8e9320bcbd2def8f7743bf90e4d36d3e9d415371d19964fac0a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
88569a4f4ce42b18888cf47f2f0512e3

SHA1
4d89485eb60ffca5edb66bff5428ea8d72b3196a

SHA256
5c2cd9786d966642c36fe6693d895dbfdaf3d7dd58cf664c14119634e5fd6bb1

SHA512
0428c35068e45efec857d8b3f9a5b0cbfbe1eeb13c8f12a3dd42984952cffb39619256f059fcf3dbb911f81e7813965cb4f7c77c5151b94ee9a764a9ac69bfb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
ba44bc6bba7375454799707481a54f7e

SHA1
e28c3386b9da785f37e5333e54d71836cfe0e224

SHA256
ea8fb63bf7c72eb81c0306ddd122b54ebc9fbe14b4b8a86a3b90da76dd24aca5

SHA512
ae6c428114f5f0c504bb3945d52e1cbb84fd4c3ee4be668913890675fe741c76fdc3f2b3f8049874d0d48df31bf938b5bf527da3dc27f1ea9b60370708d98cd5

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1048-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-36-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-2-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-76-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-60-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-9-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/1048-64-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-346-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-103-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1048-4-0x0000000000220000-0x0000000000228000-memory.dmp

Filesize
32KB

Download
memory/2772-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-77-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-82-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-70-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-32-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-25-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2772-347-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads