mydoom | 92ba5c5e04f3e74c94ac8c55ad8766162c44a3c6d898dec43708e69b5e6e9d15

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_61246263160782b2d2895e3217633130.exe
Size

28KB
MD5

61246263160782b2d2895e3217633130
SHA1

8151267a99ff01f1216b5afa5330538aae2fe1f2
SHA256

92ba5c5e04f3e74c94ac8c55ad8766162c44a3c6d898dec43708e69b5e6e9d15
SHA512

5dc119ad84ac3451db104f859a566c0b3ecaf0468780301c043cf1adf24ae9a300f6ceea0ab5830c566f38e726b99c2b10796bedefec239ebbfa7f9326717835
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNDcpHHtR:Dv8IRRdsxq1DjJcqfgotR

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 8 IoCs

resource	yara_rule
behavioral2/memory/3928-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-39-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-122-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-168-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-175-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-192-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-225-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/3928-259-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
5064	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	JaffaCakes118_61246263160782b2d2895e3217633130.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3928-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0008000000023c8f-3.dat	upx
behavioral2/memory/5064-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-39-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0004000000011940-45.dat	upx
behavioral2/memory/3928-122-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-123-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-169-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-168-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-171-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-175-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-192-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-197-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-225-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-226-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3928-259-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5064-260-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	JaffaCakes118_61246263160782b2d2895e3217633130.exe
File opened for modification	C:\Windows\java.exe	JaffaCakes118_61246263160782b2d2895e3217633130.exe
File created	C:\Windows\java.exe	JaffaCakes118_61246263160782b2d2895e3217633130.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_61246263160782b2d2895e3217633130.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 5064	3928	JaffaCakes118_61246263160782b2d2895e3217633130.exe	82
PID 3928 wrote to memory of 5064	3928	JaffaCakes118_61246263160782b2d2895e3217633130.exe	82
PID 3928 wrote to memory of 5064	3928	JaffaCakes118_61246263160782b2d2895e3217633130.exe	82

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61246263160782b2d2895e3217633130.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61246263160782b2d2895e3217633130.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\08ZTJJXR\default[1].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\08ZTJJXR\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\default[1].htm

Filesize
305B

MD5
157431349a057954f4227efc1383ecad

SHA1
69ccc939e6b36aa1fabb96ad999540a5ab118c48

SHA256
8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac

SHA512
6405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PGH3GSHW\default[3].htm

Filesize
311B

MD5
cb42662caffe525e9957c942617edf06

SHA1
615009db9a1a242579e639ee0fc7a2a765095bfe

SHA256
312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15

SHA512
3e6777f1f74f64fff6cb2bd1a81a6c08d9a64feeebc3deb7cacb8f0f41b23a5c59a8e6294b99c76dd386aaaf9043a1a252ac47910fe1801bdc2995f7b675692c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TRPPE7V2\default[2].htm

Filesize
313B

MD5
ffb72ab4faba49ad441ce07db37dd8b6

SHA1
194e13c1c32ebb6e7a1dc912261cbd58a82ff71e

SHA256
7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660

SHA512
517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC60A.tmp

Filesize
28KB

MD5
cbf4303cd3f1caa6b4b28a906682b844

SHA1
1983af9754263405bf11b8ae8e2728d3cc4ad39b

SHA256
a35a2f0e3ec16077439a3b42a017cf1bbcfbf64df079640249a3a379900a74e8

SHA512
776f2c964e655b9447a53edd5bf7443197641ae02b1baf054e5035ccf0d9319292c35bb5617802c790a91718e069fc58cbd7b1f3888ec563cb6311d79a52f76f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
dc3ba843f4174275f32be52191400a00

SHA1
ebd338137d6e1327686f6848c54b6260327b6ea2

SHA256
cb105f34c70c4bce4b60a58830173e98b222f98ee01ca01abd5e229a965acace

SHA512
1805f137bbfd95335aa47cce13ba3c67d500265dd652f9d65a5332b06415012d5821af201933661cd01854769b3d0d24df586eae697acdc3cc0ec182635245d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
2ec8a473517b9601a9a556e38bd5fc49

SHA1
ef952e244160b4d2b8c98d6a92c826889c18663e

SHA256
16b9c41c1be953bf06cebfc8502949b363e43395120e4ee8be6553f72d1e8d36

SHA512
946b8391b4de42fd502ea9a04a00e28125d76e91742999e1847fb5da71f578735896d4469568be1ee741383fb03f84e487465f1498e575a1d76155718d4645b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
17d8ca6e29181027dab71a4bf8638e7a

SHA1
af2003dde43b0a81ca5372bf63ae5918b8262694

SHA256
c36c457e94c732e106f497550fad1b4ad4a4baacae48e67b8023473d335d3e0a

SHA512
f753d95852bbeabc97d5e47d17d221825b95ed2335af86725cab041bac5bc7669e27bf5141c7cdb79a4f1a45799a0e2c964199a3c25feddc455596184cbc3918

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3928-39-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-259-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-192-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-168-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-225-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-122-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3928-175-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5064-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-169-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-171-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-123-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-197-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-226-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-260-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5064-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads