Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/09/2024, 14:45
General
-
Target
fa98346f6f28c856a88f936d7926e6c8_JaffaCakes118.exe
-
Size
28KB
-
MD5
fa98346f6f28c856a88f936d7926e6c8
-
SHA1
cfcedb2ab5b5d0b3c44072d96a94d7e6ee86ca6b
-
SHA256
624ea1f14b60a6698bd7b8a07fde3d17c69aa0030f4fe2a57063a6af38cd79c2
-
SHA512
d3e48471d963465abe8ea0031810b9583f70936fd184e8bb44e51128be9e5cb78ac3662f0fe28a5449f40b54530cde9e562acfc24bc842c932ff763df05c95e9
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNCx4am0:Dv8IRRdsxq1DjJcqfXxH
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa98346f6f28c856a88f936d7926e6c8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fa98346f6f28c856a88f936d7926e6c8_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD59533656889d25a4454335d0986c178a6
SHA112a210aaf0314d2262faad99fac6d5401a8abaec
SHA256d022eba1be90ec958b5f3cf565b0de0de8e15959d2429ecd193a20ad0471952f
SHA512a681378058b6bed5c2ff3354194db8df78363ce136e9402b3c7b975fe971a2c9ec84c5cafb5d2d6d6af21fce3f20d801eb182c62a7332c508734dd326248b369
-
Filesize
1KB
MD5a7064f0934638e30dcd9d93a2ca1dd01
SHA1c3afbf1f6a926282d282e982d47f702cedd52b21
SHA256b928fe263dfd9c6be1904fe76e0766cb05963230137045a14787fe88fb1f4bcb
SHA512652db4861a632fe50ddb6c7a29d269ebe55ece3b68bb8f0d13ec903777a289ec3da9e049575ed5dca86f4f68310e95af27f2c16cc700a2f5348436fef64509be
-
Filesize
1KB
MD56425c7979d576e332cfd3077b000fcdd
SHA1cf60784d65e1afcd7d78def4d8fb19c98f8aadee
SHA256b74a6fd2f1a1dfea987907f35e0fe3b480f3fc0076bd4c892820cc68616b6aef
SHA512651818a418487abc659b504a0fc36ed860b5fb8d8087922a72b04afb4d86100b9e946d48e06a38d73cdfa45d4d523d079fb683e5cb43ef0490f5eb36cdd4a905
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB