Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-01-2025 05:26
General
-
Target
aee227652939e3890a67611fed8643a7a185711ee712c5446d8edddd71f69e68.exe
-
Size
29KB
-
MD5
77197064bbcf582a90cb65886e33d0b3
-
SHA1
a19e23c2446d9eea54d0875e790d68b3b0288b43
-
SHA256
aee227652939e3890a67611fed8643a7a185711ee712c5446d8edddd71f69e68
-
SHA512
f0092b787e7c616232474c6e42600cc2268237174412a4b7502bcd7d810a5aa7e55113be599bdf21b2d61f6b52e442af130ec83bcd2c6d2071dd95b11a739e21
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/phQ:AEwVs+0jNDY1qi/qRm
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aee227652939e3890a67611fed8643a7a185711ee712c5446d8edddd71f69e68.exe"C:\Users\Admin\AppData\Local\Temp\aee227652939e3890a67611fed8643a7a185711ee712c5446d8edddd71f69e68.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5f30fac6f7b3f14ef0bb5ea26b4f28671
SHA1d897cbe12cea710c31a3db3ba3a2da80ad18445d
SHA2566fa3216aed45a252255dfe31c43a356be447ea2cb4960c3814c97e0881650d77
SHA5129ede915dd972bb72c8028d669756708f436a5a8d04c9ef49cac6f362d942c71c2214a33116c384764a0f69407f625e1259be9f2cfa9cc81968bbfda22a8b0981
-
Filesize
320B
MD5e3814357e32ddb5abcf2359c852dc58d
SHA18c61b3f88688ef22e6d0d403ad2ea9d017ded118
SHA25619627bb5183b5ad0b9bfb8df506a4188d22991f0819846c25792af427302a05f
SHA51284cd3846485d896482b02e5716d1a7bdf080029ccbb91156c2c73e9fd0edf533819d7123ab636b1e7f5f1e443e4c412912a26e4afb1e1281b2a36ca128ef51d3
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB