Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07/09/2024, 10:26
General
-
Target
d1b78851fdbfc2c1e0762e5db0fb320b_JaffaCakes118.exe
-
Size
28KB
-
MD5
d1b78851fdbfc2c1e0762e5db0fb320b
-
SHA1
2c39492f7226bba03152d8f8e5a87deaeea34b5c
-
SHA256
f121e6d004e33696700d3db859ccb5eee4a07f13425b3e7165fe453edbc592d6
-
SHA512
cc7dce9e079a77a6877ecd60e02086b0579f3b79dedb38587a69063f96063bc3f3137bc1556eadc9b780e21b2c7632152f46a62635a83792e2bb4eff411d0ac6
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN/SeD/SK:Dv8IRRdsxq1DjJcqfToD
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1b78851fdbfc2c1e0762e5db0fb320b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d1b78851fdbfc2c1e0762e5db0fb320b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD524d7c2a5cbcf119fb245cb750b38f701
SHA179d776dade209c57672dc3f5b7d963e2c0478af1
SHA256df66f1c4c899c5a6ad3bd40c5e00fa9a56703243fa224627e5e084a2fc51f974
SHA51213d742c87f5f4a4754173f6b5912b5bc9f23b9333db78f68c9dde2d65bfe6059a329b4da866bf6eab7c263266aa063c175cde7a5088b44a9e39f44423a5dc4c5
-
Filesize
1KB
MD532f3d03d4adbec583e193b3d52b3258c
SHA16f00e90175da17ff7bba9ebef793ef15bca6c724
SHA256c38bbe10156ab929db1bfd075dfde97bfb0b6c2d572e9ebc10c019854204419e
SHA51241f085f21a4fed16b7faca8f9c17a61e1b5613bacd4fdb4618fba47692f34ef3d47a75a2e1055388ccefe333e34b9f766ea83f908b99a0f1620482b2c80e6ac2
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB