File name:

cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe

Full analysis: https://app.any.run/tasks/248c01b4-5ced-4e11-9940-7cfe8bcbd9e2
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:18:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
mydoom
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 4 sections
MD5:

9F170512DC6DA064CE71A341BFBBF8C4

SHA1:

3E83CA96BF203C9E57E728BDDB35ED302E38D8F9

SHA256:

CFA325C1254AA7EF8B59D08534D7FE27BA83903C3A8B496C2627BDC42E4F3282

SSDEEP:

768:RmCTPPL4MbUgJFpNZzFv8q78nEEOvV2xB0Hxz+S6iqJKf:RnTFbUgXf3Uq78TY16iOu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • MYDOOM has been detected

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
      • services.exe (PID: 5992)
    • Changes the autorun value in the registry

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
      • services.exe (PID: 5992)
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • Executable content was dropped or overwritten

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • Reads security settings of Internet Explorer

      • services.exe (PID: 5992)
      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • Connects to unusual port

      • services.exe (PID: 5992)
  • INFO

    • Checks supported languages

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
      • services.exe (PID: 5992)
    • Create files in a temporary directory

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
      • services.exe (PID: 5992)
    • Failed to create an executable file in Windows directory

      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • Reads the computer name

      • services.exe (PID: 5992)
      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • Checks proxy server information

      • services.exe (PID: 5992)
      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
    • UPX packer has been detected

      • services.exe (PID: 5992)
      • cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe (PID: 716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (38.2)
.exe | Win32 EXE Yoda's Crypter (37.5)
.dll | Win32 Dynamic Link Library (generic) (9.2)
.exe | Win32 Executable (generic) (6.3)
.exe | Clipper DOS Executable (2.8)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x10024
UninitializedDataSize: 32768
InitializedDataSize: 4096
CodeSize: 25088
LinkerVersion: 7
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 0000:00:00 00:00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MYDOOM cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe #MYDOOM services.exe

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Users\admin\Desktop\cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe" C:\Users\admin\Desktop\cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5992"C:\Users\admin\AppData\Local\Temp\services.exe"C:\Users\admin\AppData\Local\Temp\services.exe
cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\services.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 007
Read events
852
Write events
155
Delete events
0

Modification events

(PID) Process:(716) cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:JavaVM
Value:
C:\Users\admin\AppData\Local\Temp\java.exe
(PID) Process:(5992) services.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Local\Temp\services.exe
Executable files
2
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
716cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exeC:\Users\admin\AppData\Local\Temp\zincite.logbinary
MD5:55CF923AB415914D3BDA352FD2374931
SHA256:39350C1FD0006CBCDE51B9EAF71A5DD1C1DD0C26DF802EFC18045A080BE94FA9
5992services.exeC:\Users\admin\AppData\Local\Temp\nscom.logbinary
MD5:11D8B3D000D7F18BD5FE0D40A922F8DF
SHA256:860C89AA471061A9A8E576E40CC24C38A852B2C3BB9891C8B68B29FDC7EBD092
716cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exeC:\Users\admin\AppData\Local\Temp\java.exeexecutable
MD5:9F170512DC6DA064CE71A341BFBBF8C4
SHA256:CFA325C1254AA7EF8B59D08534D7FE27BA83903C3A8B496C2627BDC42E4F3282
716cfa325c1254aa7ef8b59d08534d7fe27ba83903c3a8b496c2627bdc42e4f3282.exeC:\Users\admin\AppData\Local\Temp\services.exeexecutable
MD5:B0FE74719B1B647E2056641931907F4A
SHA256:BF316F51D0C345D61EAEE3940791B64E81F676E3BCA42BAD61073227BEE6653C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
20
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1356
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1356
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5964
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
1356
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5964
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5992
services.exe
172.16.1.3:1034
unknown
1356
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1356
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5964
RUXIMICS.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
self.events.data.microsoft.com
  • 52.178.17.233
whitelisted

Threats

No threats detected
No debug info