Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09/09/2024, 00:10
General
-
Target
d55878c249fe7c9874be75bdffda9c51_JaffaCakes118.exe
-
Size
40KB
-
MD5
d55878c249fe7c9874be75bdffda9c51
-
SHA1
1750bb86d2569d5d2f94a7a5020dbe3a4d590061
-
SHA256
498ea8c009413e53a5edfab4e06d707062480c9e4c314453c06ffaa6bee04355
-
SHA512
8832b6bcced1590742100d37886ccfd47955a90baa98798879aba45a5824f90b3c48ef96f9d9539a12f988ba550ca526e9dacd0da0b762be5efaac9bc8efd40d
-
SSDEEP
768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHQnR:aqk/Zdic/qjh8w19JDH8R
Malware Config
Signatures
-
Detects MyDoom family 2 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d55878c249fe7c9874be75bdffda9c51_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d55878c249fe7c9874be75bdffda9c51_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD54391e772ac21ddd78804aae096267ded
SHA194668f6f441e3f66013e754fc698b40e8dc3e8f3
SHA2565d14a09754c5818eb178076f5b3d46baffbb26aed08451ce62b43bdb081bff72
SHA512e851013e06f25a8a335e04f8b50453f539a57a3a39189833ecf23a327d156623fe4f1f738fca54620c1e8e52c3961502dba5cf21a2106336551945cf60a49da6
-
Filesize
1KB
MD5d6c7db8c754e1eceb6548e43b0b5373d
SHA12f142650c31b8ccae66a83345022651d9aa74f8a
SHA256f9172f8df68cfa6cbc416dfdac32b961f50b647b997baa7c79caa00a4ea00d03
SHA512b57effe0ef460b0edf73f322ed32ae6ee9031123d9b66d480740bbbb654b3350a929dd16a5f03c9e7f026fe14cf79cbbc40c78838f9d43d6a57ecfa4599b82e6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
52KB
-
Filesize
32KB