Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-11-2024 19:17
General
-
Target
96b35383296611ff1c31c5db2b780a13_JaffaCakes118.exe
-
Size
28KB
-
MD5
96b35383296611ff1c31c5db2b780a13
-
SHA1
d562df83528ac47ed8d93c83eb834092a7729151
-
SHA256
369e251e91baffa8775f6e45e78a5018fbeee47f37def00c7ccd213a737392ac
-
SHA512
58b241f757d9bc1786333f212fa0722a4efb6b13f258e4f4d4a296e69a918dc4884423ef335d5f4d8430504858e34a9824854bfacf8edff468c07500627b7a2b
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNF:Dv8IRRdsxq1DjJcqfO
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96b35383296611ff1c31c5db2b780a13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\96b35383296611ff1c31c5db2b780a13_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5b434b1295ac57996a1bd0b70bc5eaf51
SHA1daee7458e06affc712110f5aadfb1a4e869297ad
SHA256ae6fb561f781ea0d0ac2010d07947993a2eeeb8d091af05270590ce4a3cb3be2
SHA51229f24d338aa68b27088e1112e34b2c6693f74f6856ca68bbafb22d46d2b754ae5c0a9b7c837018e366075aeaa112c84be84c7dbc66f200c551fec5843ea41ab7
-
Filesize
1KB
MD5402367e3c6e4937e2e28c0d75c8d00b7
SHA1652950799126b3ffbd8203bd96028c9609bc6342
SHA2564ee3f966c30c77e9780885aca58a6f471dacc8bcb9dd85172385a969be54afd5
SHA5122721e1cee456574f4aa278cbba4d15500892461b5cf7dbb438764e623336603646e00ccd2439b7fd72864c10634b830ec6ffecfa6e72dc1e96c00295586ad8cc
-
Filesize
1KB
MD5a4a48165e536d52647e80c0b7aa20584
SHA1f04ec89bca5b2728310ed09c29374a0a43caf699
SHA256e56084d206b4ec4a092051cddacf876fbdff5cb2b430c45fd139a1d9b5220845
SHA5125e789b99545ad7dbed5333b22395e4f9efde70e266662c7e8fcd02737127b252d5cb5577fb48b26a154cbaf7c0b7be236ea4122505077447a7bfda945c300294
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB