Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 11:29
General
-
Target
b34a1025cdde866e050423a15dcbbb43_JaffaCakes118.exe
-
Size
28KB
-
MD5
b34a1025cdde866e050423a15dcbbb43
-
SHA1
da88d68b0d70437d10bed566c20f30c0572b3e48
-
SHA256
9c0c0043b1adb3329e40d87bc1c095abc4e99b3e07c64a1078b3eef596d1b021
-
SHA512
76970f29f4358202a0167c6284e643269ff6e68f9845cb6e7546f4f0564664fbc19d6044a028381450594873a34bd05f01cbc970a3cf05835e5ee2f7285bbfcd
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNCR65:Dv8IRRdsxq1DjJcqfI
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b34a1025cdde866e050423a15dcbbb43_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b34a1025cdde866e050423a15dcbbb43_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
1KB
MD5e6b2b4143b1c1e67893ec0636fcb8a7e
SHA1ee11e8dc01e66f9a687a2fcb2f3cb6f3305dea40
SHA25619e8cb883f2f8821cccf721467150cb3d67719ea2ac9bcaca813ce7367b5b46f
SHA512fcf7ff714be214cb1c256d885bcaf1e3ac84f47bd0d0de3655fdb3a50288100ded532b214ff8d55c30c2ed0bc1fd1ab492aae584935678c8ca6e4f4e50a84952
-
Filesize
28KB
MD5bf634557b6e5ea874436187497da94d6
SHA1c511c8a07e8bc06b184f21a1912d8335ae6ac215
SHA256aa0f4c0f65dc197738ba8373df01896607a1137c824d662c1819496a0bf42312
SHA5124234e6abf8137c3a5236f4bb6f3e728ae4f3e6b739fc1f9bc09038618dbd109b0854e19932d2bd2662a62a1b44b1c358a731401301017ffc4038628977a1816d
-
Filesize
1KB
MD55b8b8291f6b22810a629f0059c56034e
SHA18b9a1b386caad53f22c5b4009a2ee3859debc10e
SHA256bd0f81af7fe4e7f905ac4dd2ea0fde45bddcbd3959172ffff9b4273a45b4c710
SHA512c3f24bb4778bdc5cd7a3c181065acb26b8092eaca70618122b1c5a913f59f5a5ef58cabfde1ef60f8f452be5e9e4efd971226570f4aebb85be72582aaeeab92e
-
Filesize
1KB
MD5ed6dc461bde5f9effc3fdb4f6ba75891
SHA1a47a87d51034f064e337d83c48bc04f3e074cb9d
SHA256d6d969be19229e6565fcbf96df78c6e7b450018fe69582871ffc4bc7759657a2
SHA512fc5a20250361bd64545211397da908b1d57b9f6ffdbc9053dfbf2c5b35918beb5bc2da05240d6eaa2b4f6ca4bffb02f0353af492d46ac91f2811c35438907fa7
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB