mydoom | 400256351999d1c5972862646c74ed11f3e0cac13b8f7ad429dc3d79afce7c7a

General

Target

JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
Size

28KB
MD5

5900c63f2fd870b1ef9510ccd582a4a0
SHA1

b46cb2ba88c6b06b103c0559ec7cb23cf9e937c9
SHA256

400256351999d1c5972862646c74ed11f3e0cac13b8f7ad429dc3d79afce7c7a
SHA512

47a10efd02918323b2c1dfde6855f78084a136e23baca92d09ac9c5914433c011c66f8d689c7de77be46e7a9f76f1d7204eb26827680ccbdfc34b8ae2e4db018
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNTP/9L:Dv8IRRdsxq1DjJcqfMH9L

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral2/memory/60-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-44-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-103-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-151-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-157-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-176-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/60-215-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
3872	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/60-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-4.dat	upx
behavioral2/memory/3872-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-44-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d000000021a70-55.dat	upx
behavioral2/memory/60-103-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-151-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-154-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-157-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-158-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3872-163-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-176-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/60-215-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3872-216-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
File opened for modification	C:\Windows\java.exe	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
File created	C:\Windows\java.exe	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3872	60	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe	83
PID 60 wrote to memory of 3872	60	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe	83
PID 60 wrote to memory of 3872	60	JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe	83

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5900c63f2fd870b1ef9510ccd582a4a0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:60
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9IEW0KLU\default[2].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L6PPXFHA\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF375.tmp

Filesize
28KB

MD5
22d8e0185d009400d8e0173577390f37

SHA1
e4894e2586414614c1303bf6947743968b90a5fd

SHA256
1e6e6fe62a6bb12fbf52a67e531ac60012db4e76ad3a5029f0bd51fb2e25408a

SHA512
49d1e4df3c58376afecd684bcd79e5c2fb0b208ae313ee8e506ebb8491c9fdd078e2575cfe2c07dfc54070918dc08fd0a28767ac0acf67909addcad7846ae78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
b2c8978abb83e5d7c4093539ff00eada

SHA1
961f9e5b5aba10ddd6e1abba4bae9017245adb6a

SHA256
50244935085ef02d01eaa1ef70126a7e48b60daa662f07ca902c6fbd789779f5

SHA512
2b7500e8b5054a68466452274ffbe895c5c17b40db575edffd0276ea0591dbfc4eee37c2bffb2222fd9997a95ab12236d2d1c01d29b76600b82d9698a11065f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8d931d398ce3ec7a599708be5236b066

SHA1
d829865c3fd389accf4b54ec5f4f3cbee39d1be3

SHA256
1b6aa623bfdea2f0b4ac89068abbac0a70073e7c9812d2b64018b7456b912933

SHA512
3ef07111a12a0ec576cb33aedcc92722d59ed698ac6c46a2d4681be4bc3324e1cd88ed6236a38192d52a6f256508c753af03f8c9abf48c188bbec049c17c739a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
e1ad6b73fbca5049131ed1ffb0c38d03

SHA1
0fc83ff096b0f19c90ed9cec7f3c18f2d2e9a51e

SHA256
8368c7ffae53fb2c82013d069be90203dc839ea1135aca58800c3ef6c34edd5f

SHA512
e400a565ce27949ab6e77101961ec242cd091fedd23db7ef0b5ee75153a37783cd2abf5b7412c25541a8af195087bb5e761abc33ee7e8ecc6619032b90308b4b

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/60-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-157-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-151-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-176-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-44-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-103-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/60-215-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3872-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-154-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-158-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-163-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-177-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-216-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3872-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads