Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08/01/2025, 08:50
General
-
Target
a22e3175d58635f1380bc1492452d3444557d0c43cfb844f2085bb569d1d2a46.exe
-
Size
29KB
-
MD5
8a06405ac4799d658afd24c695a3e637
-
SHA1
24be065b48216f62dd7d6b4e4681f8c1e3b0bc3f
-
SHA256
a22e3175d58635f1380bc1492452d3444557d0c43cfb844f2085bb569d1d2a46
-
SHA512
57fdce1ffc871bea256f958bb74e1a56ceb5073af842f44a6403bfbf15e62f8bb290d8bb9199f727972fee89c0bc09140a0ee0490a221776ab0f946ba3b3a2fc
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/Xht:AEwVs+0jNDY1qi/qvX
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a22e3175d58635f1380bc1492452d3444557d0c43cfb844f2085bb569d1d2a46.exe"C:\Users\Admin\AppData\Local\Temp\a22e3175d58635f1380bc1492452d3444557d0c43cfb844f2085bb569d1d2a46.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD528c11c2c37731227e570846eb4f6c3ff
SHA1cd6f1d1b852e5fb0c7ec49a3386c3846e5b2cb9d
SHA256aa74f561e83a66b417e8a374a70a145730c12ad11c44303e438afb9b89b39429
SHA512147772fd22601554ede02490b57601be42241c3f5b334912e4911b8975657dac3aa17bb4c51ab3974b6f3c3ad78abbdeac6342c32efdce6380a0adfbfc9be9ce
-
Filesize
320B
MD589d8851f3f7b5cd55bff8658247bbe43
SHA1961136b8762eef5fc2f698359a16491c7c143bb3
SHA25641429b7a7d1401da532309c2ca5a67f13d5512368644044453ae3827dd547efe
SHA51238ce435fec0c0e37451129e07570a9373efb6f3acfabb6894432744c3f5b9e6b6e99ffbb5d8c668dffba286e926fe9021f6e593b7ca32096597cf8cb7a3cf975
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB