Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23-11-2024 18:49
General
-
Target
900a9629915b1bc00a63defa96d8733b_JaffaCakes118.exe
-
Size
28KB
-
MD5
900a9629915b1bc00a63defa96d8733b
-
SHA1
85e53e5de2c691be8aa22c1bd678da9377181fa5
-
SHA256
cceb93d34cd180e928953a4dec1ff55642acc31697dd815fd58f5aca15e12e1b
-
SHA512
c1337d7c60e2a2ecd53641bce6d814eb626a2c849ff12cf294bff2a82470f92d1654be3604e46da45d69eec0cdea87eb35c5f8fed3c195c5e448c91acef1bfac
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNQ:Dv8IRRdsxq1DjJcqfP
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\900a9629915b1bc00a63defa96d8733b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\900a9629915b1bc00a63defa96d8733b_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5cc6c290416d8e0f2b073c77f340cbd59
SHA1f56b702f850eb211e7573724186cf461c5a02e4d
SHA256e08deea7d367c7c07fdaab761df81b52395743e99daec1a48971394701c4e617
SHA5127af8150e32b2f107269deb25d4ef70376ab13ed724e5a51caf6f55c4ec0b5f1ebe117fbe0dd54055c083e395f7d14ba300a8c199761b39144aa68eda72dfdc40
-
Filesize
1KB
MD5d4022f99e29cf8fe1d3b2fa147bec8f9
SHA1f3c6b98426a939ae8134cb325edc395b95d09076
SHA2569fb031a0e6c9770f1f8ec504266d17dfeaa616ba0a1bfa4e34dee27a6f95726a
SHA512c78d2759634b438dbc8cedbdafd9d1577e0d0c1099ad6a57d6f41bb902f661c3754fc5326daf315fcdc597bfdee5fa4e7063e42686216c7e9c36057fb5183b67
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB