Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\mail.txt .exe

Details

Is windows:	false
Is dropped:	false
PID:	6968
Target ID:	0
Parent PID:	1028
Name:	mail.txt .exe
Path:	C:\Users\user\Desktop\mail.txt .exe
Commandline:	C:\Users\user\Desktop\mail.txt .exe
Size:	42966
MD5:	EDF4FF0BC5DA6DABD5E7B78113D73BD8
Time:	14:36:43
Date:	18/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x500000
Modulesize:	66048
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension File Execution	System Summary
Yara detected MyDoom	Spreading, Spam, unwanted Advertisements and Ransom Demands
Machine Learning detection for sample	AV Detection
PE file has a writeable .text section	System Summary
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Uses an obfuscated file name to hide its real file extension (a lot of spaces)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Creates processes with suspicious names	Persistence and Installation Behavior
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\services.exe

Details

Is windows:	false
Is dropped:	true
PID:	6180
Target ID:	1
Parent PID:	6968
Name:	services.exe
Path:	C:\Windows\services.exe
Commandline:	C:\Windows\services.exe
Size:	8192
MD5:	B0FE74719B1B647E2056641931907F4A
Time:	14:36:43
Date:	18/03/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	32768
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Exploit detected, runtime environment starts unknown processes	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates files inside the system directory	System Summary	Masquerading
Dropped file seen in connection with other malware	System Summary
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\java.exe

"C:\Windows\java.exe"

Details

Is windows:	false
Is dropped:	true
PID:	3664
Target ID:	3
Parent PID:	1028
Name:	java.exe
Path:	C:\Windows\java.exe
Commandline:	"C:\Windows\java.exe"
Size:	42966
MD5:	EDF4FF0BC5DA6DABD5E7B78113D73BD8
Time:	14:36:53
Date:	18/03/2024
Reason:	newprocess
Reputation:	low
Is admin:	false
Is elevated:	false
Modulebase:	0x500000
Modulesize:	66048
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected MyDoom	Spreading, Spam, unwanted Advertisements and Ransom Demands
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\services.exe

Details

Is windows:	false
Is dropped:	true
PID:	2604
Target ID:	4
Parent PID:	3664
Name:	services.exe
Path:	C:\Users\user\AppData\Local\Temp\services.exe
Commandline:	C:\Users\user\AppData\Local\Temp\services.exe
Size:	8192
MD5:	B0FE74719B1B647E2056641931907F4A
Time:	14:36:53
Date:	18/03/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	32768
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Exploit detected, runtime environment starts unknown processes	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates files inside the system directory	System Summary	Masquerading
Dropped file seen in connection with other malware	System Summary
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\services.exe

"C:\Windows\services.exe"

Details

Is windows:	false
Is dropped:	true
PID:	4568
Target ID:	5
Parent PID:	1028
Name:	services.exe
Path:	C:\Windows\services.exe
Commandline:	"C:\Windows\services.exe"
Size:	8192
MD5:	B0FE74719B1B647E2056641931907F4A
Time:	14:37:01
Date:	18/03/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	false
Is elevated:	false
Modulebase:	0x400000
Modulesize:	32768
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Drops PE files with benign system names	Persistence and Installation Behavior	Masquerading
Drops executables to the windows directory (C:\Windows) and starts them	Persistence and Installation Behavior	Masquerading
Exploit detected, runtime environment starts unknown processes	Software Vulnerabilities	Exploitation for Client Execution
Sigma detected: Files With System Process Name In Unsuspected Locations	System Summary
Sigma detected: System File Execution Location Anomaly	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates files inside the system directory	System Summary	Masquerading
Dropped file seen in connection with other malware	System Summary
Drops PE files	Persistence and Installation Behavior
Drops PE files to the windows directory (C:\Windows)	Persistence and Installation Behavior	Masquerading
Sigma detected: Windows Processes Suspicious Parent Directory	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 1264

Details

Is windows:	true
Is dropped:	false
PID:	1576
Target ID:	10
Parent PID:	6968
Name:	WerFault.exe
Path:	C:\Windows\SysWOW64\WerFault.exe
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6968 -s 1264
Size:	483680
MD5:	C31336C1EFC2CCB44B4326EA793040F2
Time:	14:37:46
Date:	18/03/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xe30000
Modulesize:	499712
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://www.altavista.com/web/results?q=%s&kgs=0&kls=0

unknown

Details

Name:	http://www.altavista.com/web/results?q=%s&kgs=0&kls=0
TargetID:	-1
From Memory:	true
Source:	mail.txt .exe, mail.txt .exe, 00000000.00000002.2729074743.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000003.00000002.4465723940.0000000000501000.00000040.00000001.01000000.00000006.sdmp

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://upx.sf.net

unknown

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s

unknown

Details

Name:	http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s
TargetID:	-1
From Memory:	true
Source:	mail.txt .exe, mail.txt .exe, 00000000.00000002.2729074743.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000003.00000002.4465723940.0000000000501000.00000040.00000001.01000000.00000006.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=%s

unknown

Details

Name:	http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=%s
TargetID:	-1
From Memory:	true
Source:	mail.txt .exe, mail.txt .exe, 00000000.00000002.2729074743.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000003.00000002.4465723940.0000000000501000.00000040.00000001.01000000.00000006.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://search.yahoo.com/search?p=%s&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=

unknown

Details

Name:	http://search.yahoo.com/search?p=%s&ei=UTF-8&fr=fp-tab-web-t&cop=mss&tab=
TargetID:	-1
From Memory:	true
Source:	mail.txt .exe, mail.txt .exe, 00000000.00000002.2729074743.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, java.exe, 00000003.00000002.4465723940.0000000000501000.00000040.00000001.01000000.00000006.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s&nbq=%dhttp://www.altavista.c

unknown

Details

Name:	http://search.lycos.com/default.asp?lpv=1&loc=searchhp&tab=web&query=%s&nbq=%dhttp://www.altavista.c
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\mail.txt .exe
Source:	mail.txt .exe, 00000000.00000002.2729074743.0000000000501000.00000040.00000001.01000000.00000003.sdmp, java.exe, 00000003.00000002.4465723940.0000000000501000.00000040.00000001.01000000.00000006.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found strings which match to known social media urls	Networking
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

192.168.2.13

unknown

192.168.2.12

unknown

192.168.2.18

unknown

192.168.2.9

unknown

172.16.1.166

unknown

Reserved

10.0.2.15

unknown

172.16.1.4

unknown

Reserved

172.16.1.2

unknown

Reserved

172.16.1.170

unknown

Reserved

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

JavaVM

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

Services

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run

Services