Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-12-2024 07:54
General
-
Target
79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe
-
Size
29KB
-
MD5
335df5643aa81b31621fffcc838dd8ba
-
SHA1
a640cd7245aaa1292092996430ff4a614bffd8b9
-
SHA256
79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e
-
SHA512
2ed9e3098012c88401e66a5c237d1275a63b889ae4928e916901176bafb9484922f193ed564535f166d6bce82c2b2f8e26e51764e7216091f4c8469181dd9bd7
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/hQh5:AEwVs+0jNDY1qi/qZQj
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe"C:\Users\Admin\AppData\Local\Temp\79d4221924d4aa7123848e2aa81a73e6ce0c5ef5c6338fe8010208ab8451fe5e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5e3acfad9b6f2768dc42060e50985a46c
SHA1ef307f353d6ec54da12e854c58f416bd8bddf799
SHA25683c3f1e53626db712b40253bab88ab23104d000c9b2095eeb3e24ba0021ced7b
SHA5121e88c8c2f71606ba480c5c1cb166054ee274d97b162f46c072a4f93fa83b62682a8a51adc08f758eda90756b9c0627e780b7124bfc5cfadcf4e1f9dd51f3d167
-
Filesize
29KB
MD59942793f24a6c4f317eea973698bb615
SHA1639267b1e14b47329b4b8ef2f9c897eb487f557b
SHA2564115996cd659b1efb04ba60fd0d7e669735d2b2ee49ffc233c7f72756fd7e831
SHA512931042a491e1970fca650d209ac6d15fb2b7e6a3c14148060c3608a55a0050301934b200be7f9d1c8400a3ad65667057f640b9615b501f3351ab7c7eddeb9ff2
-
Filesize
320B
MD5ab337907a8fb7d7f330b604cf3b6c406
SHA1da048a5cb616b34cb7324553f930a1cc6440c8a1
SHA2563bc8fb44b0744478589f9b709db4f0c64b42fff0e56e497c76fa936a7421c7ba
SHA512248f0c6303dece5c3bfb4bb17d4f5c1b53a7498cacbe60e9d2e19d8c0a8c2ce30c3b7b606ac35e88a4805babf5c72049ce7d25d9571cb8a402cf8a4536ef000d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB