mydoom | 0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
Size

29KB
MD5

e4c0f33384b8d465e5d385f6eb734139
SHA1

31a7dd9746a370554f85489170e84949ae534500
SHA256

0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478
SHA512

ae899ca492430d983272a49042649a012ac77ee3bdc240614e760d8e401333c973aef2dd2e99b2de64643bc20025c37ad10c7b0e4ad8bd8a1aba3e99ca7d7558
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/4h:AEwVs+0jNDY1qi/qgh

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/404-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-101-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-200-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-202-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-212-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-257-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/404-302-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
5116	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/404-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0032000000023b74-3.dat	upx
behavioral2/memory/5116-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000011940-48.dat	upx
behavioral2/memory/404-101-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-102-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-200-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-201-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-202-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-203-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5116-208-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-212-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-213-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-257-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-258-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/404-302-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/5116-303-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
File opened for modification	C:\Windows\java.exe	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
File created	C:\Windows\java.exe	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 5116	404	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe	82
PID 404 wrote to memory of 5116	404	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe	82
PID 404 wrote to memory of 5116	404	0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe	82

C:\Users\Admin\AppData\Local\Temp\0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe
"C:\Users\Admin\AppData\Local\Temp\0577f64defd0900282d7dc5e983414d4b202183fbd22ce2430714600ab0de478.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\08ZTJJXR\OETRB4JR.htm

Filesize
162KB

MD5
d081db819a37b4403b65375500513286

SHA1
003c5335fc7ff55b10240383760b3c867cd46b59

SHA256
62258429d31ab24296a00cb528e2c9da4a909a6517d40a596ccd21709cc956e7

SHA512
fd87bc338bbc83f06f0929da656035bce88ef60e62a2456f56b423fdb86df6f60969f6bf7e3e6ee7e15ec8ab42034833bb5d504a421dd971c3e1b3c519d1cc42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\08ZTJJXR\results[3].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\JB0ZJRUS.htm

Filesize
162KB

MD5
c49d731f7d77bebc6bfebcd4ccf00117

SHA1
941802258bd88e909fa7571939caee5d7ad46cb7

SHA256
48943b4a88c768b89d6f2b9ac0832494c3e1ca091d871ee322bc8311ab3e89f7

SHA512
ada816f7ee5d330a1f855854d6500e78ce6365c4e9ee9578b1fcce94d1458b9151c7b81cd3ab8996a6cb8dd5f62e5414514b29c839edcbf7288a2f32b86d28c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TRPPE7V2\default[2].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TRPPE7V2\search[4].htm

Filesize
142KB

MD5
ff073e550a12bd31a562e6750817ee18

SHA1
511a7216255b316d30c6141a4a34b1f5dddc3f46

SHA256
a44018035916004730775988d6cc2e0faba072c215e5d8cd1d5061a6bfcdaa15

SHA512
b31e67de0731c0ac1bc8884c1889b7a6030d87ee2e3f0f10fa888b7ba2a5756a46aae46db945e5b480dbc49278411208ce7df276d7a16f484623645d5599439a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X3JA8BBM\search[5].htm

Filesize
149KB

MD5
aeaa5d4607fa9a7a468b35baa245f22c

SHA1
bd477073449052d7685795bb532c47f72350e4e5

SHA256
0e873ea2368d173d20655056019a4d47e108df85d207bc264536df2c447e6854

SHA512
7a568f7f3280ec4659f7aadf20325eb4858efffa32eaf394fdabffcefb5788e1d638c087c0518a8253b1aaafcf3b11dbbd0eedfd8acf8378997e8e38cdebb410

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB039.tmp

Filesize
29KB

MD5
19635e1f7b8e5926941d6707a9b26953

SHA1
e9648033005f5cdd85901b2c640a81161ff93aa4

SHA256
689d24771bfd1d659f80c2a919e53f2a3480d7d02970365a257e8d7a0d3c24ec

SHA512
52b461f8b6554dbf03e7e0e8f8fbf9f236e736d77684803ec32c21c686784d2334952422af40b8fb47cc74960c220536f765072c3e61531aa143f74bf8c25612

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
8cb1700e61b63a851666c41bb81f5181

SHA1
e65d648d025e3062fa111931134234a30d6a303b

SHA256
30a252ffa4594b73961861cdd0d014114b96109aa930612c9ce9c8ffc183c89a

SHA512
8a113f8e552aab85dc42075c12f8fadb60d6b32cbd5499fc2e87f63a9e2a388e54e4c95b954c5958c4535766c7abb6fa46fd6964c0b93648dce9a22bbe8cb7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
352B

MD5
004c621964bb634275f183a46f73cb1c

SHA1
7e5f3e5e6c43161239efeab5e8c53192f3f4ea6d

SHA256
ba1b5ea0809cbff60ac4c0ab36dcb0dcc16c1588e672895d26fe0a09a0674af8

SHA512
ca7b58070f1d5df6cf6b57d9902113af3a268d87770dfa12802d3df0ad79737d98d810d207369761f5bcb3008184475565787e895c7ff0d5d2de571ba166b915

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/404-302-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-200-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-202-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-101-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-212-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-257-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/404-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/5116-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-102-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-201-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-203-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-208-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-213-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-258-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-303-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5116-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads