mydoom | ae4ac58e0c8e0da73b46a000b34da71b94e18fb7a177da212e4448dd889b8db9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
Size

28KB
MD5

efb9101f39fe522be1bccdd4ef047e62
SHA1

66ec2c90b76f3d8b98ae44119a3c5093a1491500
SHA256

ae4ac58e0c8e0da73b46a000b34da71b94e18fb7a177da212e4448dd889b8db9
SHA512

e84597f8ec128daad6c072895544669b47cd0a1cbcb5f8ff9acdb0c8037e1686ede5a8c99b285441ea6a745ed229026e380fd7828d1731910c063b98fea9388d
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNzDtXj:Dv8IRRdsxq1DjJcqfMz

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 9 IoCs

resource	yara_rule
behavioral2/memory/4764-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-39-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-156-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-212-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-214-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-219-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-235-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-284-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/4764-333-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
4876	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4764-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000b000000023b8e-4.dat	upx
behavioral2/memory/4876-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4876-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-39-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000021ea9-53.dat	upx
behavioral2/memory/4764-156-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-157-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-212-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-213-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-214-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-215-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-219-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-220-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-235-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-244-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-284-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-285-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4764-333-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/4876-334-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
File created	C:\Windows\services.exe	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 4876	4764	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe	85
PID 4764 wrote to memory of 4876	4764	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe	85
PID 4764 wrote to memory of 4876	4764	efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\efb9101f39fe522be1bccdd4ef047e62_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\search[2].htm

Filesize
118KB

MD5
6e809c65ba2181b15745a1e60fc4671a

SHA1
212ad592536ad9b048997a452e279145d45a257a

SHA256
7400129e3ccb8c1e6d59e74e9f42a179e3f226d4ebad796212c4bcb98f57b2d8

SHA512
1f321d7c08e73e079ba736ae6d250cffc9ef1c94f4e496a5debfd3dfb7423db23ea323cf0bd011ee4c3e2f873de506941aadac5cf4221ad182f5ae823b14a42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\321WJBEQ\search[3].htm

Filesize
116KB

MD5
9ff24f4f30b87d5e004b9910ec7c760d

SHA1
80bdd8e1402b3ab4e690fe215736ec53f6abc982

SHA256
1158b1d2a000faefeac4d142695d4cee7210ba4610683e8bcf3d50f0bd18d130

SHA512
983199acc94ce6877da5f1f5b78e355f029e20760957c7a450d57b8bb6ccc34e5e8bca3cbe68b6afebb78fdf4d60b60a09d6946d7660ba38f728ecac173ea85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\VMN45W3V.htm

Filesize
162KB

MD5
b834f59904f35f0b6924f073f46ddc25

SHA1
3c167f58311b54b727058f9495046af4363d3ab1

SHA256
0026b726a228d0d6761547c04392ef596060988c656ac19e2f15bc8e54d5f0f0

SHA512
7f712d87eb7f1ffb81d52d571882ce416ea2764deaf3d3b22ded521265f232962cc44464bc1509beedd6136e9db320098ec779ab1bb08453b031bfa5f73a4380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\search[3].htm

Filesize
123KB

MD5
f6317016521f7b872d922448fc8c64d8

SHA1
a91db62e1581409798ebf2ee8adfe1152f4261f8

SHA256
1483ecc6415ec99a0f63c4a7551bf29641179c10b249b20513d499e6bb0fd05b

SHA512
3134bf3ebc4579cbd6d1742223502e8398ffb144eb7424bc92abe50aca7d46ac97ccf276a1e63dea068ed4df58af767014597227dab0608089e0b0715185a3a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9MFSIIMR\search[4].htm

Filesize
133KB

MD5
2631b5cf7fd1511740dd44558a40120a

SHA1
92e9a2b9a35c399b9b4b18e91c291fa7e262e657

SHA256
5653d80fa9df831e35fb1ecde0447fb9a817cd3920385e5b88ce890d134f2514

SHA512
fa5ccd17b51cf2bb55c2eadcbbdd497ce39b3c2caa92062d2e41b1d1a95de5bcedcbc1719db9b082cc267200a028505e9a4915e996d045b84d10b5c79ff9b1e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\U2VH17MA.htm

Filesize
162KB

MD5
80547633474b778d4aca187f07d6372c

SHA1
da6ad21a3381c38635a9e410433a0f029759147a

SHA256
b45df1309b51030e1d12772c7ad5fa9ee346d91d0557d9967520ecb406f0fda3

SHA512
a4c3a397cd2e90a5de7fba9079e877fdb806f1a396f6a31531f7f9f3e0e11872cc28d70e1ebb74e96f9d28ad72955230f7d9dc51c140cf5a1fbeb6fcc7c814f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GRYMSCZU\default[1].htm

Filesize
310B

MD5
2a8026547dafd0504845f41881ed3ab4

SHA1
bedb776ce5eb9d61e602562a926d0fe182d499db

SHA256
231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce

SHA512
1f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\default[1].htm

Filesize
304B

MD5
cde2c6ec81201bdd39579745c69d502f

SHA1
e025748a7d4361b2803140ed0f0abda1797f5388

SHA256
a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f

SHA512
de5ca6169b2bb42a452ebd2f92c23bad3a98c01845a875336d6affe7f0192c2782b1f66f149019c0b880410c836fc45b2e9157dcccc7ad0d9e5953521a2151d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\default[5].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UV4TX9UP\search[1].htm

Filesize
142KB

MD5
f400a2f60837f982639b69b5f6a23ed3

SHA1
8bab8394cdb72b2ba0d541dd777e488dce80352c

SHA256
792e7296813fe4c0b4e6ee058d9e1f8d39b82d248ad2df5cabc54923ebaf716e

SHA512
a88cd8a6e72091fa78af2cec4983c802d69f5bf3013e852032afc4b2736e0c158313b832c50902021c300b07664cd6582a3b4432f46ada07ea36235c597fb074

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE200.tmp

Filesize
28KB

MD5
360ee4021ddf96dac8dd31c5ea57c2b7

SHA1
dc3e84f5fc03a4f08c7bd5c5e1cac2fb6d072fe6

SHA256
e9da083a5ad46dde48c89f649813dd523d6ed509a1d597434b57a2cd935c0b10

SHA512
f15e0f52e00e52769d868bcc7086b4c6667f63c6bc5761d1c9c3c7b5a5ab1d9295aa9f646aba9aa907d7cbf3abf831e7be9658e6aa1bf3f36b8a6bd36e3020f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f1c4ba32bba70eba2529461c273f526b

SHA1
8fb3878a0a0593d2e6b52360e6903f7343df578a

SHA256
b8fa0ac71e22e19485e1469bef29d9f8a36b07ebc1ab5c97e8369424da96ee30

SHA512
df4bd35bdd7f080c244e1c59bb7fdd1c44f33e1fc9c8c1c930484c2b4fb05e69cd6db834a0e6d5b320c0e91bee134f5718110383dfecb630cef856b3bf4e9bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
e1be21c6ff18593ec182d35b1dfd00fb

SHA1
90ae497cc67b29dd20369fbb61b55fa011ce8713

SHA256
579266d6ccc7f2a6faf17b9ff48f2098586fb40f0463fee4d24b82688819067f

SHA512
edff4a0a63e31453d63e3265176ddb24ecf1db171dc0ee843fa7fd4bf2b27b31cc6e6fdf258eee64bc46da614dd3ff4554c66bc185c17011708238c33d9d6c2d

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/4764-39-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-156-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-284-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-333-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-212-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-214-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-235-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4764-219-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4876-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-220-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-215-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-213-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-244-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-157-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-285-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-334-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4876-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads