mydoom | 275cc8e0b4cc83379ee4e41b286905a7f511bbe5b31da059e2e5b801932fe3e6

General

Target

JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
Size

28KB
MD5

7689527d593a5097ee05378f4ca25396
SHA1

02cd3b5eccabc561a715049b67758de8de92fc2f
SHA256

275cc8e0b4cc83379ee4e41b286905a7f511bbe5b31da059e2e5b801932fe3e6
SHA512

8fca26909409c79512e9ffb7c62bb05021ac1206b73fefcaf7ad801c4f52b73b88f5d7ed406cf50a56f3ffac58d845a75672a705aac50f6b539ca143caaaaf3c
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNnuD4:Dv8IRRdsxq1DjJcqfMus

Score

10^/10

mydoom microsoft discovery persistence phishing product:outlook upx worm

Malware Config

Signatures

Detected microsoft outlook phishing page 1 IoCs

phishing microsoft product:outlook

flow	pid	Process
93	2460	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe

Detects MyDoom family 6 IoCs

resource	yara_rule
behavioral2/memory/2460-13-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2460-49-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2460-183-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2460-224-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2460-229-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral2/memory/2460-236-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
5908	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2460-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000800000002433c-4.dat	upx
behavioral2/memory/2460-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-15-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-16-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-28-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2460-49-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-50-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000d000000024142-63.dat	upx
behavioral2/memory/2460-183-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-184-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2460-224-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-225-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2460-229-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-230-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5908-232-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2460-236-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/5908-237-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
File opened for modification	C:\Windows\java.exe	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
File created	C:\Windows\java.exe	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 5908	2460	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe	86
PID 2460 wrote to memory of 5908	2460	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe	86
PID 2460 wrote to memory of 5908	2460	JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe	86

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7689527d593a5097ee05378f4ca25396.exe"
1⤵
- Detected microsoft outlook phishing page
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MSRA1ROA\2CCPA0UY.htm

Filesize
153KB

MD5
a14d89f646b0cd4df1ad7d2e2c8d8717

SHA1
f7f324a77a0e51e1fd920ed694dc1b943553121f

SHA256
2da44b9093518595dc6a4969e6c80cd4ea7a7fc33dbae2f706b56bb552d05ae8

SHA512
91365e92a11f03cbbe2995243144ef2a6299e118e8a4eaa884c93b1f44c020f54016e98471fbeb5c2dbcec827a59fd3496a27cbf58490e7eddc84722a009283c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MSRA1ROA\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WP7READH\results[2].htm

Filesize
1KB

MD5
23c80875746a4681a49ac6fe4d3e66a0

SHA1
c82c5ba93d49d6279a3ca43ad321f79c188b4679

SHA256
d666bdb067d011a430abcabdc007fd93724bdeb4933196a07b9661ae04a9c3ee

SHA512
15bfb1576ec56c0404926055f438132027bf1e33b8de9ea1af6ee4c879a099db4a44b3c4e7b95d644e587e8313e82f789ad35d3bc89b7b54235f465d1b1190ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WP7READH\search[3].htm

Filesize
117KB

MD5
428528c841c31329c1fe12f2473ad141

SHA1
16f396b5272c87a02cf7d6ab653becb52b846766

SHA256
cfc50ed625e9b5362c1ddc8c9b4679df0d01f1961d055ba07ea884273cf757fa

SHA512
c22206c971ed596e70bccb259df20aef7a91f06e11b901f6b09580dc2d95ac5f7bc1384f5470641ca42139b108f882c9ddfd571f1a7df6347b7797e22abf9a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp96.tmp

Filesize
28KB

MD5
1bb1bbdb053f7f14242628365cea33e7

SHA1
21092e7ba22bf39d1cbf94e69ea4f68fb8e48685

SHA256
f9fdc4fbdd1084715dd5f10760f3c92a295d435ae8f2e01390a0bd7cd275a7a0

SHA512
af85651249d81ae412beb34ebf198ef5aea04f231ffcc3394fd6ec34fc9e623acbe84789cc0d3852b032c22dd1bbb4b380bddcd9d9fee55edea31c77d46aea35

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
8a9496e2b4f01d28bb1273d9a58d0398

SHA1
330155927986588f5f55d18e19fc9e4f485691c2

SHA256
ddbbbb010428737c56123717dd1212b1e0df91a9a08ea0159538ea05765c51d3

SHA512
8a33f4a71d2b9f3f6cc16d922ed5ea225b39d14b91f18b3e85644a2bcd199be30ffc6c1a7628accc2fa580070e209481875dcc9a78517f4d2dd3e5360861a025

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
6f3cf62ee3a470e1bd09f09693c4c865

SHA1
d161a83508442b045f4f56756f207bb543528877

SHA256
f4c720a226aa2bb4fad16e9027d61d37c5fd35fc6f1bea3193f82f624d2f3a14

SHA512
c3a1cc1c1e6b51b1e3772f33c8f6598784c750838d90e8cb1ed586b99e02be0f25ec5e2b3bd0fbee4e1493aa3c01bbe3bf66180b3c9dc08d9b2a590a316d8171

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2460-13-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-224-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-229-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-183-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-49-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2460-236-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5908-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-50-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-184-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-40-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-28-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-225-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-230-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-232-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-237-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5908-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads