mydoom | a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
Size 40KB
Sample261002-glgl3aac48
SHA256 a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846
MD5 981f4639949b1cb8c38cd79dcb2e7c72
SHA1 33670cff099b0523afa1cabc6fd3a32d878cdac5
SHA512 212b5fbccec95eb2ec0fe101c04fb8ce1348ca03b794cd346f63b633357c6748203f60b24a1aab617f96d04106dc900151f8fac21c5208d32a8116a7592bfa54
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHXo:aqk/Zdic/qjh8w19JDHXo
TLSH
T1C4137C73544095F7C58244705A80EA62AEB9ED771749D343F6D0AA4EECB84C76B3CF06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mydoom persistence upx worm

Malware Config

Signatures

Family: MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Detects MyDoom family 3 IoCs

resource	yara_rule
behavioral2/memory/1908-0-0x0000000000500000-0x000000000050D000-memory.dmp	family_mydoom
behavioral2/files/0x000e00000001c567-17.dat	family_mydoom
behavioral2/files/0x001000000001c568-49.dat	family_mydoom

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\services.exe	services.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\services.exe	java.exe

Executes dropped EXE 5 IoCs

pid	Process
456	services.exe
2744	services.exe
4996	java.exe
2660	services.exe
1504	services.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\services.exe"	services.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c563-5.dat	upx
behavioral2/memory/456-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2744-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2660-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1504-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-75-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-95-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-105-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-111-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-118-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-133-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-151-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-160-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-196-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-218-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-234-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-238-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/456-256-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	java.exe
File opened for modification	C:\Windows\java.exe	java.exe
File created	C:\Windows\java.exe	java.exe
File created	C:\Windows\services.exe	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
File opened for modification	C:\Windows\java.exe	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
File created	C:\Windows\java.exe	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 456	1908	jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe	89
PID 4996 wrote to memory of 2660	4996	java.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:456

C:\Windows\services.exe
C:\Windows\services.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2744

C:\Windows\java.exe
C:\Windows\java.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\services.exe
  "C:\Users\Admin\AppData\Local\Temp\services.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2660

C:\Users\Admin\AppData\Local\Temp\services.exe
C:\Users\Admin\AppData\Local\Temp\services.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 471B
SHA256 9edfb873015e8e3a766e02302c7ab601aea20b49c27d53a2cf77693fd2482459
MD5 9583dcc81f11050020455f4c784a20da
SHA1 3a87c3541afee4ff34347794fe89986859f6d993
SHA512 20822df58ef220741fca5122f5766edf83d8db34d3853ad1a21e9ba23525991d367f6192335cbc40f1f0545c3c7979c8ffd23c32b3768f0b2ef5672d94e1f26c
TLSH
T17DF0DC03C0FCF0523F9248CC59B8773E343090FB0E59105EA02D8CB28012675DA1B4BA
MD5 SHA1 SHA512 TLSH

Submit Download

80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
Size 420B
SHA256 243980d811dcf8ea77d6137fb2e05592cef08b50227f89119e6cab8621009a00
MD5 f0f5131301c20c1f8f28ff298b9fcab0
SHA1 95e744aba93270656a08f76fe3995aad0125f8ce
SHA512 4d1fd5eea2208e198a4679107eccf73f76a60f62446fbb321c9281dc7df295a9ef877a535ee9a2efa63ef3c5c59e4983ec9f47172be7cb0f21094407c00c35c7
TLSH
T1C3E0262C12FB421EF5E6E4398BDAB0319569F166182AE27119D95B08BB29D40FC02B33
MD5 SHA1 SHA512 TLSH

Submit Download

search[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3CC7WCI9\search[1].htm
Size 155KB
SHA256 fbe1648ddcaba6ea0ddd40d02fc0ba8551698d4b88ea737a5b6b20de0075f5b2
MD5 4425bde0ffdb03fbb3be6ec69a10581b
SHA1 598ee8c4592f0d4c032811eb05de54d71412e896
SHA512 f5292b80399378b2889f067c3d73ed925dd8e0c13eee8eba13259b8eb6bea7a5b0fca12d257a1c4caddef1856aef8d5be4b163a46550dfd256e12a366584646e
SSDEEP 1536:5RN/GMJoamI1MYB9JjEoeVJvYIJFYcn46SThYTHaPTyEQGdO3l7LleflKglEQlfZ:9SIe/Ycn468Oee7DRIwbaQ1cC2LRXqkD
TLSH
T19EF33AA271F07477166FB092E02B370CF0779B27C54A95E0F2ECC4915BAAD9E2647B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3CC7WCI9\search[2].htm
Size 158KB
SHA256 c57c560b5af4dab97f03e42a05039bab28668bad352b67bcf4ba092d1555e338
MD5 2e0fc1cf6c668891f7f04ddad90afd83
SHA1 cff25fad3c2c57dd6bc0211b53bbba25938718f2
SHA512 5ee12453a2bf6adb9cf814319e1da83a1c9acea1b3bd7dceb2b1a3edc37a8e04e9eb68da052b2a82c3bac8a4a04eab212ca7677868638251aa4767396f40af12
SSDEEP 3072:FSIemLRDidhrCVTMawO2gJshm6ZAFXqk1:F7ihmWAFXqQ
TLSH
T1DCF3297171F0743B217FB195E06B3708F0A3976BC15A96E4F5ECC4A14B9AD8D2A07B28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MTNU6HGG\search[2].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T7KVIYDE\search[1].htm
Size 120KB
SHA256 bfe312eea4d0e46ecf7dd4e91e09d5a24d8d9621af22be469aa2880b36908fd9
MD5 78a0621c747ce1ad82aa484a552eb887
SHA1 08af6e16a3a5606fd94201e26b1923b8e95200fb
SHA512 339a3ea9f14b81fa49fc76b5d5817c3ed1076edb524f350d4d162ca85af6d4a740305f1f83cdd6bdf5a46b20ec1677e05125d178803d1ea22b6e222fbf543557
SSDEEP 1536:w6Z/GMJoamI1MYSjS+iUcjSbjaZ+6ITg6T4NTM3TMZZl4p2lxnlcqNBweM7Kmwmt:lSIe0hZ+61POIZ8pweqNB/M7jXqkX
TLSH
T1E4C339A1B1F0B477126BB096902B330DF077972AC45A95E0F5ECC4C15FEAD4E5A4BB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nDCwlvty.log

Path C:\Users\Admin\AppData\Local\Temp\nDCwlvty.log
Size 1KB
SHA256 d1ab19971cf106344ecd331be1f6e774f3f558b290cd67bb95f7597b61bb2adb
MD5 f2c7c9eceb513f8b55970fd41708f8de
SHA1 cf4b2c1d2e32fedba0c328099f4685cc3fae6c1e
SHA512 da0889b13b8a697b6597cefbc001c54548d2e982b649663e1d499649332d28f615f1800b38ef275038cdf3d5d0c3800916c3b22aef16e8e78fc17f878019bb30
TLSH
T1EF210ABE4D16596E73BD12ED3333D223A6D3128889013BBECCAED94551A4E1646548B8
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6A7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A7A.tmp
Size 40KB
SHA256 d036ff185be7c19bee3e88e2f018110046ca5ea5b31f31b9312c986f0d19c1a4
MD5 3ff2d596ccbf6d7fcd4fec43faa55ff2
SHA1 ea027d01b5497d21d6a3f49c921af4b77b5a382f
SHA512 5f154636ecc4d791d923077a0e5f60926430318b802aa6876747808b2b0d54d60e1efd6eb5f7e6831bdc32ec0d7f5714f0044a56ecc6c5d4d427c53c74a1c6fc
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHA:aqk/Zdic/qjh8w19JDHA
TLSH
T198137C73554095F7C58204702A81EA62AEB9DD771749E383F6D0AA5EECB84C76B3CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 085945e3a8df2af6bb2b644a41d3b6877775ba528a4da9843efef3d4463e1e1e
MD5 d277f58e88146630be214df9ae6be045
SHA1 00fb3d608e8d001ec5a52db741d0a621c2baf5b3
SHA512 2bceba6b7f83a3b104d269df1d79b538453c29734dbf6dbceab6f1d2f07bf385817876a0a883c934b11a23f580a130fe226892d5f82c0af5dc4095b2763f6220
TLSH
T16421DABD8E09556D73BC23DD3327D223A7D202C885513BFECC9AD94562E4A16C6108B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 6778760eb44fe6d304b9f32f02ea4e545f6ef12855c795cd5909653dcdc71d28
MD5 b616d995cfdd4f7cbdf358d3d9e2524b
SHA1 e0ea8fb2109ddd41e18e06b0f8c10baa6e696909
SHA512 fcf8dd6a8e2a4c3b770a438c37e0f081813e5f9c40700f6da695703f3ca1cc108d4b55e72ee2d32e955016cc77660364ff40e9876fe4b425e6c21c28113949bb
TLSH
T1A6210AFD4D5A547FA3BC27D933239212B3D202C8C8013BEACC6BD85950D4A1742244B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 fc7a33b2d1fe0a1ca8a644db05b9e76c7bec31188782ab078b4b5713b1514867
MD5 fafaaef4d8e4dc7239069a14a0669df3
SHA1 dd37bde9603dca9cfadbef7165602b3bd82b1e79
SHA512 6877775dd74f1caeffac88580c2a1299ae078227939ac15ac515cc7853b17d2493e0a85d5ba40c2303528ca7d30b7e1af60b62f7f06361f063012853ee3b812b
TLSH
T176210AFE4B09556E63BC12ED3323D213B6D222C859023BBDCCAAD80A6194D1642108B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 1f42b1407dde33cda716543385e34f36741220f972c69dc8c4d16a9bceb6e02c
MD5 60c7cb6e10867bfaed2dca17f9caa57e
SHA1 793d0cb5392511ba9dfd2f1f9a59f5eb5da002fe
SHA512 675977a259f92772cb9796883599312d2f96495d410d317358d20d446595da76d7bb4fca86961156c5b86ac9f82d3f806b6788376bd747b59b3492e445e8272e
TLSH
T146210ABD4E16652EA3BC23DC3323D213B6D2118C84513BBDCC9AE4045194A1646108B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 c397b538a136a7f5853d94ff739b5a89214c53a3d91c1ddb7fd01062adc21c36
MD5 58b8e9a35de0e2fbfbf4c3610eb07741
SHA1 e0f235e1c9818fb1157a0b7b17a9f865709930f1
SHA512 1a1606e52b7c97fce35dd044956568ab48a461def4fbe1d0aaaee7709b78fa257430096595c88b4567fc7cb1a0107440ef52048abf6003ef9d9610efd5a3f745
TLSH
T1B021E77BE91F71E958E0E0BEE840E412828BEA1376F1A19F6CAE610B35A402553428DD
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 a897cc2ae060fba5134326701d99482601086f7dd08532b20e2aa558e0468238
MD5 be85d43d8089ed1c08a55fe183abe8ef
SHA1 8e82d3820f9ea4ef4023b09983c2519ac47204a8
SHA512 878e6736da0f2420550d93e42ca87f496177860445b59fac25b82014dde09dfc5f8c68164d2a9669159ca8c2ddf917a2133fe917d6475f5de08a91ff4aaf6998
TLSH
T174210DBD8E09696EB3BD23DC3323D223B6D311C885013BBACC9BE90561A4E1647549B4
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 fe3f2d4a7ad20f17e8b9f5ed3a2cdc5fdac219f1a1080f827ad1c3b9bbf76ab1
MD5 95f4f42664036e596f4801ed7f2eaa5d
SHA1 489c251752a74c0669003e7a2f2516ab25f571c5
SHA512 e81f614a07407a58f1f7f392a532d49e465908ad5ebd7a527d1229810a4538f9e55818f3eb38b5a1f19e34a53dcee07d5b070e6f6cfd108c961855b5dc328b8a
TLSH
T12F210ABD8D16B62E77FC73CE3353D512B7D202CC89013BEACC6ED4156198A0686118B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 32B
SHA256 e06b3e12b8db9a694d486e32f0c722c77cf197b0f010726850bd1e0578a6aa79
MD5 1479aef0cb9ae71777290d466de99203
SHA1 55b4412770f9217700fa70afff1d3890b7ba9232
SHA512 f94f3463615ac09a5c5a246cac898f6395be48589f36deb0e5c1bfe7839ae7158cf3e667612a11099a4588b69fe2bf4cd982ee5325ed400a59f6ae56c676e23a
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 32B
SHA256 ab144600e6ff36b4c9f91524a1711096adde4a5a92c2f3ce3d20b2beffcd61d5
MD5 35321e4218f90b4da1ff8aa9e5f56db8
SHA1 c318e2e3239a764808c724dc994e95d312609327
SHA512 b0988fe3a0bf38d376c2d02a7a7c343983132616d370ef51e97c7bf9beb2fd3d8f2af41245c98984ea7a588099a547595650fbe897fb19c4ffcbeb74f1bd46f0
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 1f06e4b3cf34878de8686be756205544d7eb8ecff66be0fc0dba85237ef0b92d
MD5 b2cb3f5e9cee9c313f510fd6388ed8c7
SHA1 f890db84dbf5b8e8de5da95667d6436999b95fe4
SHA512 5802ea56c1d898214b3274e5f2ae62ade4c6a8a52fabb9118d42d1acb641578eea6df54fcef5e68c669e4a27c831c2520d96028e45897689b182c818ca16756f
TLSH
T15F210AFE4E16656E73BC26C933279132B69302C8890037AACC6AD405A0D4A178A109B8
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 e4286e80882af78c85fcf4e3a6c8d218aaca83690c2eb8618fa4d2c16b95127a
MD5 8b6e435277c9c4f4a628195d88735fc2
SHA1 52251198d1ad8cba19850bceea20d34ab13a82f5
SHA512 53de5cb41e0e4445a4e95a21a77dfa15021f4669f73a300aa3979dcd11841ed651079854c3d1036a9d54232180860af29bf0515e61fbf9bfbaf18e4db98a9929
TLSH
T17C210ABE4E1E556E73BD23C93317A112BAD302C4C95037FECCAAE515519471681108B4
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Windows\java.exe
Size 40KB
SHA256 a3645b938e371974350f657f7878beea6aaf60ef1f903b7e0139dd89d89f5846
MD5 981f4639949b1cb8c38cd79dcb2e7c72
SHA1 33670cff099b0523afa1cabc6fd3a32d878cdac5
SHA512 212b5fbccec95eb2ec0fe101c04fb8ce1348ca03b794cd346f63b633357c6748203f60b24a1aab617f96d04106dc900151f8fac21c5208d32a8116a7592bfa54
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHXo:aqk/Zdic/qjh8w19JDHXo
TLSH
T1C4137C73544095F7C58244705A80EA62AEB9ED771749D343F6D0AA4EECB84C76B3CF06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
TLSH
T1BCF18DF4352C375AD079333FD313D005A26CB82005EF8B26FD890BBBFA66168551AE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-151-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-160-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-118-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-105-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-95-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-75-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-133-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-256-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-6-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-111-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-238-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-196-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-33-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-234-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/456-218-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1504-37-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1908-0-0x0000000000500000-0x000000000050D000-memory.dmp

Download

memory/2660-34-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2744-32-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads