Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-12-2024 03:21
General
-
Target
b7764bb4fc2232e87bba23665c4612d4460254fd3828dac672a0666ea97863e4.exe
-
Size
29KB
-
MD5
99cc5cd4ef51697e83a45efa17d4e715
-
SHA1
a30a925259434cf8cf5e7f7521397f698c358f0f
-
SHA256
b7764bb4fc2232e87bba23665c4612d4460254fd3828dac672a0666ea97863e4
-
SHA512
117857fdaed781f3f3497ef63710a052c14baa47cb336a92e2ac7ef0a4303a9497e79f4a888e9bfc4b2753cffbfad4b03d7582845d8def6b770fe53896e23fb6
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/r:AEwVs+0jNDY1qi/qz
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7764bb4fc2232e87bba23665c4612d4460254fd3828dac672a0666ea97863e4.exe"C:\Users\Admin\AppData\Local\Temp\b7764bb4fc2232e87bba23665c4612d4460254fd3828dac672a0666ea97863e4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
303B
MD50d3a14475768406d41b5db01c66f4890
SHA1fd8ead15d5e3f8e250bbe94e9111152e15d4ecc4
SHA256e137656f5666ba6251441618a2d44642ba00fc98e20be002307289fe996c4c7a
SHA51203d2ad111dd6f5632c27548b25ae0b392a88b9ed2f2cd5b3f5c32aa4b594b727a88950c03a6cd77fc8c548ab945a14ee3e9cf58e8e95fedf527cd6d8987b9194
-
Filesize
303B
MD5304020da0635396cc7ab1522b34c0ea4
SHA1a0c4e727123af3486a48db6809df14a76952abfc
SHA2565cd263a661ab96ebaf8857e10fe96bdc4736a6043da1b6357ef616a4470c1fdf
SHA512135f05ce98a4e9d81d6720c0e4eb5f3f43ad5858552fe9786b68c6038dab88d62d2f46f8e36b8bd8f515f41e5cc2aaf7da2d81e9d6f020091e615195307cb1cb
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
320B
MD5492f89db53701bb76e884a79e038dcbd
SHA1b611da32724829d4602c321760a310f97253e177
SHA25681d8db9001d18cff63917e62b545e67e62185ca755e26c837b8500539df89bca
SHA51261301c9ae141f6dd7cb8ea9ec6a1813d14acb3ce32eefbdd31caad3b58d070714a69181d7523894c6ea66a92d10641cfa0273c105459b7b192d7cf575f4ffb22
-
Filesize
29KB
MD59d174b354e24e076050fcc782fb53723
SHA14eca58868b0c002b13b98c27d7e38609db099a3d
SHA256783a30b3505d1ea24f54c654bc69858ff195fa5496b03329964acce9d3d24a6d
SHA5122f4aa5169103ac6808b8e7899338a5ca653ccb32428fa2ce6fe5c29f654865d654bc0ae89bef450a5f92566352349f536fde87767e9e8cea002ff5e97e701574
-
Filesize
352B
MD513e9caa2824c93a0c6e443338aa3b1d9
SHA1b0b8e5216651519fb5e0026150d6f0da8b95f500
SHA2565e7b26b5d8254ae582f12aa56cbc013af2bebd25c38fa906ac9be0c0dc9c1a90
SHA51250959fd70737f29f358e76ef665f57aae8eb20356e34a799ea48a7e4eb98833035aa8d899ddd085c33e558c844dce683e686b36c31a0dbe29ac2d3c3b7cc3741
-
Filesize
352B
MD50208a782b7754ff4b3e890bafd32e8dc
SHA1e49b6f4be4cd8db9e547641321aa533ed4ba0657
SHA2569373dc721d34cac1dad82b1cd0e43c717a4b2f5e1d17e2fdcd99dace77e5f7ad
SHA5120c412c6cc58ece3b6b95ba49f95ac3ccd9c245b17fba5d627b31d698f723ee15bb4a7d678761365f8ffab2a16dadc37d734faa495afee417c42045951196cf4a
-
Filesize
352B
MD562533a59ae6e799c31edcbe77dc55ce7
SHA1e531d1946dc3024c95b9b0eca114f00177f46395
SHA256182e6ae37999a112b26413fb5199b15a0931a27ccfbbf4f5c3c490752234124a
SHA51256353f78c7257268be12a2495bc601fbc7fcc5e2ba26fb2ff42de59e84c8b944f4fa0a1f1468dba3ae92a0be6a2ed447800ad7e5fa2a7ce6566550a515fd30eb
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB