Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-01-2025 06:10
General
-
Target
07289d9c18a5a9ab65b3063326ee878f14849976aa030aff49ec66e8cbde1f00N.exe
-
Size
29KB
-
MD5
6595b8ab979890e15ac1dfcc0d3ff6d0
-
SHA1
9359c6c0dabee8adb53342c6686da2433a545156
-
SHA256
07289d9c18a5a9ab65b3063326ee878f14849976aa030aff49ec66e8cbde1f00
-
SHA512
7dcf2ff398a794c08c5487a974cc417979b62077485e682d7b558b56e7a79c09fd80e3e9d74631819b88c1a309396fe8249919886669f86b146c604b34586c66
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/25:AEwVs+0jNDY1qi/q0
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07289d9c18a5a9ab65b3063326ee878f14849976aa030aff49ec66e8cbde1f00N.exe"C:\Users\Admin\AppData\Local\Temp\07289d9c18a5a9ab65b3063326ee878f14849976aa030aff49ec66e8cbde1f00N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD59ccb5a3da74c62428e03864968bd218a
SHA1c83549e7c0092fe1db43b247f7bbc8dc5c432551
SHA2561754839f12e1b6f1f0b93621fcb952cdf5861a9ba4d0d47ce928d0806341f3a0
SHA5124344841b4659155d0233b57c62e6124668128af47733f13c37ee82cd22d90f8b899f641807134727969605479e7fe967540233f9d376fd88de7459999063c84e
-
Filesize
29KB
MD5549c9df3e5de0ef9816f88e8821b6b5e
SHA196337d0a689872597629844a2aedc26d20b5daa9
SHA2564aa0f8d2e0c50da5168f132a310ee9cd5fcbae91c9b1d3e213364008c0c61136
SHA512d7110c6887ce859467ade757c3273fe4478ebae8264d647df2f5ee26a5bca9cd519291357b5290766793873d5dfcb91d885e8ec52d098b3c7eb2fb7a2ed674dd
-
Filesize
367B
MD57e017c99f5f3e500faefc85243580f19
SHA19af76f43740b4b6e613cfe341ab7030a9075315e
SHA256d9aebdbf5946f20c14f008bc089b4ee2865644b6ad2c3366e83af89fe996d4ac
SHA512babe616cecc221d37c4d5cb3b6c2845a0fabebbf5da485577f5c52cf51798f06b43de0efc9249199984a47858a5ceedc85f7c1ad1ee471069deb10934a0deb88
-
Filesize
352B
MD5675f846964659e09e320389c50412db2
SHA18b91a9a7d536ee66c53f5ddc5d0d6ae01f4fa728
SHA25622ed572808a26ceb89e2c8a54e42090b882766efd74c8ad11da079a7653d82fd
SHA51268a887560a56ab638b345993742050bc3d6325e1c0ef510bb1c8a47f663093a1c0f02360444b1c624b565c5d40aba65e4e26c26362805d21ed0fa1e46b2d1374
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB