mydoom | 822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
Size

29KB
MD5

4698f3958862da3361e8f9631abecfe4
SHA1

cbae1d7d9db6f4710f90d86edb28a04516b429b6
SHA256

822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06
SHA512

ae3f8c083bc0712d7e9a53edf513cc5db08b6bdeffaaf01a42796a135d991aedc58bfeb5b544ca84c61f5da5d079b48cc91027c2da6bff596af151bd9acb9f0f
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/4hp:AEwVs+0jNDY1qi/qwT

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/1928-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-39-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-138-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-188-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-190-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-200-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-256-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1928-296-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1796	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1928-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x000b000000023b7f-4.dat	upx
behavioral2/memory/1796-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-39-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0003000000021ed4-53.dat	upx
behavioral2/memory/1928-138-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-139-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-188-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-189-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-190-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-191-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1796-196-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-200-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-219-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-256-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-257-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1928-296-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/1796-297-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
File opened for modification	C:\Windows\java.exe	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
File created	C:\Windows\java.exe	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1796	1928	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe	83
PID 1928 wrote to memory of 1796	1928	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe	83
PID 1928 wrote to memory of 1796	1928	822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe	83

C:\Users\Admin\AppData\Local\Temp\822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe
"C:\Users\Admin\AppData\Local\Temp\822abd3b47b4afe7023fc0622c5c8ae49fffe20b7ba6f4d955450e107858aa06.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2YUS9Q6F\default[2].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\search[2].htm

Filesize
124KB

MD5
f5d4b75110dece24fbc8e739bd2c2131

SHA1
d3a68935eff0abdaab6cf32ce15b26093c2bf16c

SHA256
c9a65a4da7e0cc2bb069c3508f6f5a1ae3ad6e91b00992a6faa77a95ae0d87db

SHA512
a298e1e321decc54a608eb8fd0e7bd6d148a8561ac7e1dbcfbdecfad43642feea85da9541b715f93b27a884d17d1eec517799bb3f3c77fee615030cf1bca903d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJLDY7V\search[4].htm

Filesize
116KB

MD5
8da655420d549b9fbfc21eee0c6b7f7d

SHA1
4d27d7e73e470b246b2dd142ba76e72639c83cdf

SHA256
bef7b946fce95174204c0bb95562f7a34026dc0094e64f3a5e4eac2939ad795e

SHA512
5ed4c2186423ea10af2bea802baf1480b59168b5128b396917438cfd4ebcea0257728ac1abc2b10389e3ceb296f2837853971236bb4c0c65f9a08e1fc478260a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\default[1].htm

Filesize
315B

MD5
14b82aec966e8e370a28053db081f4e9

SHA1
a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

SHA256
202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

SHA512
ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\default[2].htm

Filesize
313B

MD5
ffb72ab4faba49ad441ce07db37dd8b6

SHA1
194e13c1c32ebb6e7a1dc912261cbd58a82ff71e

SHA256
7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660

SHA512
517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H4VCA4X1\search[1].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp20A0.tmp

Filesize
29KB

MD5
95897bf7c165fd952f755b5a0596eff6

SHA1
fa814e56fae12436e385df5ac39522e5f3e4f48f

SHA256
5fa59c66ca460a4f6cbf338130b6c6dda7f1fb280774e60a01abcee9942b1e67

SHA512
e58cabd6e4f45cea304d1d3c86e846d611f34394d644ea6e4039d3ac1b7f86da4331bf5ea359f15ce5f403f92982e2810705f8c32f8bf8601de4779905f4f31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
5ca88d24d53a3499315a40dcb3d0134b

SHA1
f822a4a73e562cf109ee8ddff51a5711dcd63108

SHA256
d7c563ea1fb83d59d0c26f2df8ea716b8497756455435d69c490c546e06f3ac2

SHA512
fd83e5db578bbd5b65c491894709b2c61641951589486de9b8b018d9a47900e90b21353f19295d52f5f80b03a66a0abdc14ba5ab582e8456d07f7b8200062852

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
fcca72f214d75a17fd2bed0187e046b1

SHA1
ac340cf33d6c2a39da94d82826d7b30d576dc131

SHA256
93aa23e5b775df0296dbd3d2b422e1006bdac8a3e4a6d1d97f472ea0592cd7aa

SHA512
236fadbe82ef1a4f41c1b787d881436615ab526cb0e6377172ac65f5cfd37a405030fb3c1cdbb8f15e0592a4977fbb89a5a64457a69f17a1bf88fc6276dc4ae3

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1796-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-257-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-297-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-219-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-189-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-191-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-196-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1796-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1928-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-200-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-190-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-188-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-256-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-39-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-296-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1928-138-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads