mydoom | 75ad8bca3c51655db9e69dabe9301b9bb32e3cf50d49d98f2a1e238d87e26fc3

General

Target

f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
Size

48KB
MD5

f07aee3e25fa7ab6321043af29eac4e3
SHA1

c853b749634aa196871f9dfa2ac2a1a142a1aa11
SHA256

75ad8bca3c51655db9e69dabe9301b9bb32e3cf50d49d98f2a1e238d87e26fc3
SHA512

d509e397790d3f706e843e8897106325c9978a2a8c5531eee8b177da6635d6b37789fb72a8798c9b648097895b835459b4e39959e9c40e68512efeb8fc7458c5
SSDEEP

768:jv8IRRdsxq1DjJcqOVBLUvTd2wmDkuBgs5vY2HJvqRTkoCmq1UrHFfUv:DxRTsxq1DjCBBLUrGaeva1CmRrHhUv

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral2/memory/2880-21-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/2880-66-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/2880-71-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/2880-168-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom
behavioral2/memory/2880-196-0x0000000000500000-0x0000000000515000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
552	services.exe

Loads dropped DLL 1 IoCs

pid	Process
2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\vcmgcd32.dl_	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\vcmgcd32.dll	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2880-0-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/files/0x0008000000023c15-12.dat	upx
behavioral2/memory/552-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-21-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/552-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-27-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-41-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-46-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-52-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-54-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-60-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-65-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-66-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/552-67-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-71-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/552-72-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000000707-73.dat	upx
behavioral2/memory/2880-168-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/552-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2880-196-0x0000000000500000-0x0000000000515000-memory.dmp	upx
behavioral2/memory/552-197-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/552-201-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\JAVA.EXE	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\WINDOWS\SERVICES.EXE	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\Windows\SYSTEM.INI	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File created	C:\Windows\services.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 552	2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe	83
PID 2880 wrote to memory of 552	2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe	83
PID 2880 wrote to memory of 552	2880	f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f07aee3e25fa7ab6321043af29eac4e3_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCB84.tmp

Filesize
48KB

MD5
7daa6a9fe8b2dfe18903329f7035540c

SHA1
2a82fd0791833754a1ca405ba5a76c3ddfa6fece

SHA256
201657c9829ca50886939c9cb8d9f98192d2e8719153adb9779a4b18c4fa500f

SHA512
d2877582c85c3cd133153c2d7a40fcb9d7e3ddf42739b0ffa1cf11024b2ee03b046c3ddf99d460fdfeff2b6b83fc8e6b3d833ddedeeb396f4f9f02fbca39facc

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
6cf3df545a9c9fb9478bf6ca17f49981

SHA1
16ca5062900f5fc70f69331d0a8a1f40700fd94f

SHA256
5cae69c1878861ca5132b1e183cadbb723bf0dd4309131924e8db4d8d63046bd

SHA512
39124c9bdda538d751ec64585ba947c0203f43483be65690bf3892f3c6258bd9c45e984d21cfd4380aa2adb6605bca9bb83c0af1c0e9841613f1c10b4d15d4a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
c7703fc0c980225db0af6c80d435ed94

SHA1
62a865cc4c01ab85c052e29f029d67568f9ba01e

SHA256
ac3ecf04ae9490136d5ca81f040714915f771da6734cb74486f770358f90a72c

SHA512
9872c94f1a4bff23dd6250adc50e30b74221e3aa7853f8252628fb554dc2875f8852351113350b3346ca697cda52b47108a80b6d8e0df127a598c8ed49fd109b

Download Submit
C:\Windows\SysWOW64\vcmgcd32.dll

Filesize
36KB

MD5
ae22ca9f11ade8e362254b452cc07f78

SHA1
4b3cb548c547d3be76e571e0579a609969b05975

SHA256
20cbcc9d1e6bd3c7ccacbe81fd26551b2ccfc02c00e8f948b9e9016c8b401db6

SHA512
9e1c725758a284ec9132f393a0b27b019a7dde32dc0649b468152876b1c77b195abc9689b732144d8c5b4d0b5fcb960a3074264cab75e6681932d3da2a644bc1

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/552-54-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-201-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-34-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-39-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-41-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-46-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-52-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-197-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-27-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-72-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/552-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2880-66-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2880-21-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2880-168-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2880-71-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2880-7-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2880-196-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2880-58-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download
memory/2880-0-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads