Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 11:50
Behavioral task
behavioral1
Sample
jdsohjaixv.exe
Resource
win7-20241023-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
jdsohjaixv.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
jdsohjaixv.exe
-
Size
34KB
-
MD5
abf2dfd7d6c4779df1672f93ff84392f
-
SHA1
75b7b6535875312d97e0479f3abd937dec5163d1
-
SHA256
eabe397ebdacb6323ebabdc5be57204cb74761a05bd78f10135758e8f1f55e3b
-
SHA512
7707e7efceb26a9f2203204d1657a9591d16df1cd09ecaa9c1370d04c49cb2cfc34c7c9605ea3d937a7766232d09c4dd9d62772a6661eb8f756cb0651d9568d8
-
SSDEEP
768:I+Qe+mvs0FmSMuD/dvWJrn3DK3NhdsrXs69ynkP6m:ae8SMuDd+fK3F6Xs6kkym
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 15 IoCs
resource yara_rule behavioral2/memory/3252-88-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-89-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-142-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-158-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-165-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-174-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-184-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-192-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-198-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-201-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-204-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-207-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-210-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-213-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom behavioral2/memory/3252-220-0x0000000000500000-0x000000000050F000-memory.dmp family_mydoom -
Mydoom family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000c000000023b38-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 3252 jdsohjaixv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wqloaoh = "C:\\Windows\\system32\\kcae.exe" jdsohjaixv.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\kcae.exe jdsohjaixv.exe File created C:\Windows\SysWOW64\ufnwm.dll jdsohjaixv.exe File opened for modification C:\Windows\SysWOW64\kcae.exe jdsohjaixv.exe -
resource yara_rule behavioral2/memory/3252-0-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/files/0x000c000000023b38-2.dat upx behavioral2/memory/3252-4-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral2/files/0x000a000000023ba8-20.dat upx behavioral2/memory/3252-88-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-89-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-90-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral2/memory/3252-142-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-158-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-165-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-174-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-184-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-192-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-198-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-201-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-204-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-207-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-210-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-213-0x0000000000500000-0x000000000050F000-memory.dmp upx behavioral2/memory/3252-220-0x0000000000500000-0x000000000050F000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\mthzwal.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\zumhjaybnezmb.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\uyav.exe jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\bdcrzg.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\VGX\lkhtcd.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\awvkh.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ikslncpgny.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\beysqiaj.exe jdsohjaixv.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\aikoajjzbg.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\gblnpxkh.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\klwla.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\kab\rrqrbayyxyjd.exe jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\itdqpd.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\ginhrvwy.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\dgnyggyau.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\nflr.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\rsjmxipfpb.exe jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\mtrjupbs.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\ronjlwbz.exe jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\fqtzy.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\en-US\eihdgscilyd.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\nfmevq.exe jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\kceofotyjbdv.exe jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\twpu.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\rmvmkmdyu.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\bbvockl.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\fgzqoayd.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\frprw.zip jdsohjaixv.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\elubdl.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\bhhs.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\yuuut.exe jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\hljpkappvglkc.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\kmjpm.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\erjbkqgd.exe jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nb-NO\gbyvpbavbcjh.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\jcwgdnt.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\qlpndcttc.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\vcbbbehhpyook.exe jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\innbbox.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\bmbjvcwpmfkgq.exe jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\tydpk.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ejsrxlmtjugqw.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\wjputi.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\eiikohubqud.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\vlbnotn.exe jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\ipadxeqpt.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\sntbtjeberyh.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\gpegqfpwce.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\vudvhrffix.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ddrawocrvfgwm.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\as_IN\egcstunil.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\pbwcmfklgu.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\eptqvhbnmj.zip jdsohjaixv.exe File created C:\Program Files\VideoLAN\VLC\locale\is\lhmone.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\jpeje.zip jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\swetozk.exe jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\rsqhjie.exe jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\tlmewcpgi.zip jdsohjaixv.exe File created C:\Program Files\MSBuild\Microsoft\kvjoa.zip jdsohjaixv.exe File created C:\Program Files\Windows NT\Accessories\fr-FR\oklplodh.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\kdpojf.zip jdsohjaixv.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\crzoagawu.zip jdsohjaixv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\cqhpysfqoyawi.exe jdsohjaixv.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\mqmnio.exe jdsohjaixv.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdsohjaixv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe 3252 jdsohjaixv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jdsohjaixv.exe"C:\Users\Admin\AppData\Local\Temp\jdsohjaixv.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5abf2dfd7d6c4779df1672f93ff84392f
SHA175b7b6535875312d97e0479f3abd937dec5163d1
SHA256eabe397ebdacb6323ebabdc5be57204cb74761a05bd78f10135758e8f1f55e3b
SHA5127707e7efceb26a9f2203204d1657a9591d16df1cd09ecaa9c1370d04c49cb2cfc34c7c9605ea3d937a7766232d09c4dd9d62772a6661eb8f756cb0651d9568d8
-
Filesize
9KB
MD567972a465ff299fd78fbbbada65ed8bc
SHA1d03ef506ae59ea6a2e46004c3459bc6868f6ebec
SHA2560fbe1d4a2fc666252b4310478894b247fdb8464908c9f91ec103eb4898b3d21b
SHA51209227638392e4abacb4a0a864a486fa827384f4a0fec4c6e414c76378f1ab79c441ffed292a068e593815bb79fe41dc9af3342e7fc30d3916cfc778a8a8b4bdf