mydoom | bd1d70940437fec72784ca6e59e837680b9dcd063ae2db507abbc2d7502d5dad

General

Target

e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
Size

61KB
MD5

e4dd89fb632daf1344ccc2e32a175ae5
SHA1

c6eae965c2b8e57bc4494b4974fcf5717ac63ab5
SHA256

bd1d70940437fec72784ca6e59e837680b9dcd063ae2db507abbc2d7502d5dad
SHA512

f5a00510fa5bc8875b4a424acccede9289539b75fdbf424d266353d11a3ea4fda1be5be30d53fac87c676fdde75378171eef49ce27361e71fb6774f55dae2e96
SSDEEP

768:Y/q9m/ZsybSg2ts4L3RLc/qjhsKmMJ0UtH/hY+JFfJcqfF:Y/qk/Zdic/qjh8MJDH++vC4

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 4 IoCs

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2128-9-0x00000000002A0000-0x00000000002A8000-memory.dmp	family_mydoom
behavioral1/memory/2128-17-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/files/0x0004000000004ed7-47.dat	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
2192	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2128-2-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2128-4-0x00000000002A0000-0x00000000002A8000-memory.dmp	upx
behavioral1/files/0x0008000000016edb-7.dat	upx
behavioral1/memory/2128-9-0x00000000002A0000-0x00000000002A8000-memory.dmp	upx
behavioral1/memory/2192-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2128-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2192-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-29-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-42-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0004000000004ed7-47.dat	upx
behavioral1/memory/2192-59-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-64-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-68-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-69-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2192-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
File created	C:\Windows\services.exe	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 2192	2128	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2192	2128	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2192	2128	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe	30
PID 2128 wrote to memory of 2192	2128	e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e4dd89fb632daf1344ccc2e32a175ae5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328bcd498075259c4c5444552bc67d9e

SHA1
63b960eb29dbe00ef1b324ced081cb51d834bffd

SHA256
f2e5bdf29cd60bef9cbd6ec7d2f8787deb6714a74a6e773f2a68ebc8d58c1779

SHA512
a6f8e1b3c808aec3620e0270bb03a2affc5d256eafc050e7a0c902c77639acbd14e89a4096d9502fb68f6865c77c67b3aaf1e8ce1d0758430fee0aef42dd2b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF92E.tmp

Filesize
61KB

MD5
4c276a81218ca7715c91616f5c020a7e

SHA1
6b920deab26443992e7268bef41c2a653b39e35a

SHA256
766335123f149d898058ccfb1e875959ad015dae8e1509c60d17c5534eea9154

SHA512
b2c839e675058df8e65ffdd4faca297f5f3cb73f2a38e4a3ac8cec2a940cf564b370d47cfbd3b77ed9c4b67176d8ab0004d0a9098c4661a8547d1586ebcd32bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
cff9e1bc9f391f891a1aa30771206962

SHA1
312a1d2901538f1c01c95909f1f89b77ec324478

SHA256
4fd0962a788c72f21d4f7238244e42cecc8e710cea3cdb3c21a05cd5d9c8400f

SHA512
71e7c7967787ef0d313175c6bab2b8efc22c97ad5e4f3b026af36eb343598ad028b81d79f320648e832c37284f154f1b34c800ef07b81152664caae952beb93c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
1e74b816fb639564a465ff8a9a95fb2d

SHA1
ac00bad68c13ec9a9d2b0badddee1adfd59e2340

SHA256
c98f2a65ccffc85a482952074cb4855c0b8fcdf64208b8eb95dc57011805b4f9

SHA512
994d23bc381777ef59a50320d9d09d598617bb1ce6f07039efc738a4a1bb74b88647140c196108544f3287bd102a15e68ccd897c812c5d7088e22ead9fcbd940

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2128-9-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2128-18-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2128-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2128-2-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2128-4-0x00000000002A0000-0x00000000002A8000-memory.dmp

Filesize
32KB

Download
memory/2192-37-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-42-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-29-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-64-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-68-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-69-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-24-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-19-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2192-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads