mydoom | f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2025, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
Size

29KB
MD5

6e0c85e20296d4906ceaba8dff5422ed
SHA1

3830bb4726b273aa653b4bc12eb53446bbe16e66
SHA256

f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced
SHA512

44d225bdbddfc9ee377c6f9574404664d3f83d79aa8d41a1a796216d61b2bbf53b8838f0d57bbde6b84bc3c57a880e9a7db08161a49e4c7ad1a3caed4ee8fe04
SSDEEP

768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/RnhV:AEwVs+0jNDY1qi/qpnj

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 10 IoCs

resource	yara_rule
behavioral2/memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-32-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-132-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-134-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-144-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-163-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-175-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-189-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-233-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom
behavioral2/memory/1976-237-0x0000000000500000-0x0000000000510200-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
812	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1976-0-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/files/0x0008000000023c8f-4.dat	upx
behavioral2/memory/812-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/812-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/812-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/812-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/812-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-32-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x0009000000023cae-43.dat	upx
behavioral2/memory/1976-132-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-133-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-134-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-135-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/812-140-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-144-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-145-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-163-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-175-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-176-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-189-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-190-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-233-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-234-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1976-237-0x0000000000500000-0x0000000000510200-memory.dmp	upx
behavioral2/memory/812-238-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
File opened for modification	C:\Windows\java.exe	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
File created	C:\Windows\java.exe	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 812	1976	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe	82
PID 1976 wrote to memory of 812	1976	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe	82
PID 1976 wrote to memory of 812	1976	f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe	82

C:\Users\Admin\AppData\Local\Temp\f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe
"C:\Users\Admin\AppData\Local\Temp\f7e6fd7ed06d216fe71ed134ac26a7fb0f7233e3199ade0b71046dc94736aced.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DQ67RYHS\KSD0XWCU.htm

Filesize
153KB

MD5
fbdc09b91e2ad2447a6af7812ac34eb2

SHA1
a6715d508b35c9f46cbe5f306fb458431da5c909

SHA256
4406c014b101cc4e5a5f953a70fde9edcc0508f0838f77b4d6f5002da62fb537

SHA512
cadade0ccb162532f012bfbcccf5e460fb5530fe838af6ac2a84876257ddf976586b4796336a93fc5b3b7053db81afd78364e8a8dd905e3bd68036c40c3026af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFY08QA2\search[3].htm

Filesize
116KB

MD5
156e80e3f27e96e463b8d6c6d2792ce1

SHA1
1882732f52350338c60907d49025605ebc5c6687

SHA256
90047dc9bb70f72e7f6e4d6670f1c2d33b5ad97ce913330ca29046cf4cc19fa3

SHA512
3a259a39cd396c749437a3bcb191c609f9635d9b30df34ffc588bb01c28ddeca32e2a3f748baadb48919523647722ddcc48437f66c7758aa9cabec8af296a0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\default[3].htm

Filesize
312B

MD5
c15952329e9cd008b41f979b6c76b9a2

SHA1
53c58cc742b5a0273df8d01ba2779a979c1ff967

SHA256
5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7

SHA512
6aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\results[1].htm

Filesize
1KB

MD5
1e9fcd86233e9dd64fe3ede39cde9488

SHA1
c66ded700b8f007ada5d0e7da3403b46fa43187c

SHA256
a3d1c0671be23488874db9266892cf3dd4fa6245e3f3aa820bb3b7fc3bb26c53

SHA512
e9c44c04ba854a7790012ef61561b67ad49066e9279486358076ad58217c3b967a0c2728360c73c2bdb108e92d272a16e5d9d108439a699853bb35c533366b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PTWQX4L2\search[1].htm

Filesize
107KB

MD5
cf398f580381b8798fcdfad74e8cf869

SHA1
cf2eac736117fb9c66a061d5ed87d9098cda6db7

SHA256
90910ff3313cc8911d4a16a6304301ed186f42bea3a79ff5d891e23ff97c1e59

SHA512
d6c3a3cc37f8d15b3b8fb1bf3d58d29a1e95b3d8f3c81102fdf32db75e13512605f1bcf366ad5aa3e754641435cae3e0e2a8a06ad7be5c83caeaff0a69523adf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp941F.tmp

Filesize
29KB

MD5
d97ea780bf35111e85a0121e8d2fe50e

SHA1
737084c022f406cdee7df9637e0423b3a0b5ba2b

SHA256
4728f414fdf101295701f2d5406a637ed889afc06261fc896f02c162dea0dd46

SHA512
798abfb916e17449c9e5b5c51cb4371605fd8c912e39078cf099ed1547fcd0015a739c83e5513ec0d9aef682eb5ba113829698376b82b949531751444050ad47

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
668a4d00f5f79a85b5bf854ed7f92764

SHA1
987cdc5421433b7cab2e105e986bebce504f5be0

SHA256
39d4c00492028dae50ded8233c087997a7303bd03eba50599f3462097edbcae8

SHA512
d4f87b858a6761fd48203d4832570bfcf7bea9874dbbf80f3f87113dadd66ac708ca602c50ee49b7faeca89aafba5826de73b379ed82232d91340c25af42c16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
61f60a4f33f078751b6769176dbc197d

SHA1
cf49102736a230d522932a334c513456a2dca274

SHA256
0792581d3d880d86549c9316ef233dddd8c3b3f525b9ccdf99d14613be696cc6

SHA512
24323e27500dc60c6ee96de8ec96cbe98d8dc1a7acbd55787c6d34926c50575cbf0cc2978ce80ea92a337d319c8123985ceee966ac79db16e686a8d21565e17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
c57742b7153a2c83ba46fafe7affecdf

SHA1
3d73868bf1723bf4a58ba0734bbd4f954500f4b7

SHA256
df12e548b0140646c8b9c4e63b3a610929729932891d093103d5a01bd75baef9

SHA512
40869fefde5d85e0c42067176f22b24204d72029e57dd88d807726dc7bddc065a31259ba007138f228838a757aa42815f2a4143beef1ef2c2379f60ccda3d010

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
320B

MD5
65e20a5d7f24c96535f7c3542b4460b5

SHA1
395b3d5547b2c60873ab03c7e69250678256b42d

SHA256
1e06b99c8af57b8226aa543a159e9a60f92191794ea5e0c5285b353b52fc9e06

SHA512
04c7d8194859ef920f646fa3751d484669d7cdcf66fb05f87fe37d44a96b4d97d3dd8e2ecbd81409fd0ee03bdf1f57558146425b62a78ca0f9c21f0c7dc43e10

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/812-140-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-145-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-133-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-164-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-238-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-176-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-234-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/812-190-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1976-32-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-233-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-189-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-237-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-175-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-163-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-144-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-134-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-132-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-0-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download
memory/1976-13-0x0000000000500000-0x0000000000510200-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads