Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 02:49
General
-
Target
bc5c18999b91492d0e4b2ab637a555128bf5edd6772c563804a65eff074d5e7b.exe
-
Size
29KB
-
MD5
cee7ed16815b853cb820034af11ebcfc
-
SHA1
d3f2e6c88b318746726527fe64aa11a06bc3b94e
-
SHA256
bc5c18999b91492d0e4b2ab637a555128bf5edd6772c563804a65eff074d5e7b
-
SHA512
0808e32189484373043463b077d267f9a298e2948a1df3936d932763243f4acdcb4bfc15b98a7dcfda85b1b149729058a6d400309d957d1b4030f72154e24189
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/xhQ:AEwVs+0jNDY1qi/q5m
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc5c18999b91492d0e4b2ab637a555128bf5edd6772c563804a65eff074d5e7b.exe"C:\Users\Admin\AppData\Local\Temp\bc5c18999b91492d0e4b2ab637a555128bf5edd6772c563804a65eff074d5e7b.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5d5f1201c3fa60b91b971797386f649b2
SHA10e86e8f8e293fedfd3e7e357673a856691883dee
SHA256ea51c54ac3fcf8d8e50dda8267f332f67ecbc2575774d45b53a4839b4e3719b1
SHA512bfb0b3f4c8008ee26309e09f28f4e0d82c7411c8e31a934a762c70c25c9a07877555db0feece23369f7b04b835490e7185c74152c924b1d96e6c7cb79220508e
-
Filesize
320B
MD566519b1c967a2004d9f2257507265e5f
SHA16d544f8715a956a0dbab924d3d5af64f1c81ac8d
SHA256aac512a8cc0c7ba3bf93d348b9e89652ebcdd81ab0757e3dc82405907ea7e92b
SHA512fff474c577a2ad9eaf248c4181707e6ea31792f413a41b9a7b150f4b8c911cea635058b575a527b502e3a993590af00cd06bdea3e67612174ba553a73928c8f9
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB