Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12/09/2024, 04:15
General
-
Target
dbcb1f47aacd98923697769c66e83fb0_JaffaCakes118.exe
-
Size
28KB
-
MD5
dbcb1f47aacd98923697769c66e83fb0
-
SHA1
75e9e86d105949f99c515fbe30df72cc2dbf3400
-
SHA256
6a8cb264104acf799491a265a8375f749f32cf48a7efc2c1289f0cc3bf72730a
-
SHA512
8247629fdcc8c0000cd638a01b19fc7e2249cb91aab7b2ffeee39afc72e18aea61539cb7e69716055390221552f9cdfb529656d83d98747a0938a165c9546c69
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN2FiK0:Dv8IRRdsxq1DjJcqfq
Malware Config
Signatures
-
Detects MyDoom family 4 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbcb1f47aacd98923697769c66e83fb0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dbcb1f47aacd98923697769c66e83fb0_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD582baf9648156c66c831ea4a9f9eba12c
SHA1244693e0b419a8fdbcd03893533314ab285a6241
SHA256315af56725204d057ac4aed60ed14b71d8ea62f1d8a67625a7c6156e4d270cb9
SHA5124c954d5ddeb095967db174244dcbfe7eb041c3430163688c3087895b0b81581c89200f623adb7927c3ced3b66a6f7a5df669267145fbde0fb1222377110c3e26
-
Filesize
1KB
MD568262d7d0ce817a6f59412d0ebe05d6a
SHA1fa0089d5199ca5b107d1fd115df2322f42c498ca
SHA25604b55518032c8e25efaece0e20749d663206ee9420b98d6ec847e6409ac0ee93
SHA512bebf6e98abadcce2254044452268789c252670f485b84f6db354b5739cb28ee8839f5b8ed270464abcbb5c7840e73e8d158f6f63c6507f2c428476514107ec0b
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB