mydoom | 251d120ef93ad1386f54ad7ffe046037852341ee5b4f4c63b1f97479e551d9c6

General

Target

JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
Size

28KB
MD5

6bb2ad74445235481f930c85bf9c2e14
SHA1

d4942f52bfe858e0a09db6bbec04b6326e2a8a7a
SHA256

251d120ef93ad1386f54ad7ffe046037852341ee5b4f4c63b1f97479e551d9c6
SHA512

575d491ecdac681a1e77865a3583b4cf96ab14efb0281e70f60cdf8e1af5902cc10c8fe047fdd3d1de4fc7489d6cf4533e5db5e82c41431ead40c290a2ef0a5c
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNYpuzb+:Dv8IRRdsxq1DjJcqf3z

Score

10^/10

Malware Config

Signatures

Detects MyDoom family 5 IoCs

resource	yara_rule
behavioral1/memory/1600-17-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1600-54-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1600-78-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1600-82-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/1600-84-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1444	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1600-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1600-4-0x0000000000230000-0x0000000000238000-memory.dmp	upx
behavioral1/files/0x000700000001868b-10.dat	upx
behavioral1/memory/1444-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1600-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1444-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1444-55-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1600-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1444-57-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0036000000018669-70.dat	upx
behavioral1/memory/1444-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1600-78-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1444-83-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1600-82-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1444-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1600-84-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1444-90-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
File opened for modification	C:\Windows\java.exe	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
File created	C:\Windows\java.exe	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1444	1600	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe	30
PID 1600 wrote to memory of 1444	1600	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe	30
PID 1600 wrote to memory of 1444	1600	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe	30
PID 1600 wrote to memory of 1444	1600	JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8B9F.tmp

Filesize
28KB

MD5
dd29b69d3eaf216c7145545d54feb173

SHA1
7f87844454dea4e95a5ef471d9dbafaf9cd14d99

SHA256
f47f8e1c3317388691f487ed528e98399e8cbaa69e2ce38d15cae37c0946b01c

SHA512
502a6bb1784eaac8870827d4428e7f58b5e0873f9945ad1906d1e9e81e72cfb65f28709e6b7bfc602f15f04f7d7665cf8c54a8886823fd97c4fad2dfac76dfbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
5f21be9b9edf0871d49f63d6041dc993

SHA1
ae6fa70f4e8b764970603cb94991ca71d0264b18

SHA256
e740bdf7bc6f85cbc2ddfdd5f52d30698aa3340bf817e7f375c97636c36fd69d

SHA512
2ce1fa0ae6d412d6a66a38e9e6be5f177f3ee47b67ab93123cd248bf0c054e1ad03d830e254dd30ef43e488b02e3ad765f85a552524a083b5231f1e4fe0fbe4c

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1444-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-55-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-90-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-83-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-79-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1444-57-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1600-9-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/1600-4-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/1600-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1600-78-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1600-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1600-82-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1600-18-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/1600-84-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1600-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads