Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 12:55
General
-
Target
a7f1cea428dcdd38bf0f5debf51f93a4_JaffaCakes118.exe
-
Size
28KB
-
MD5
a7f1cea428dcdd38bf0f5debf51f93a4
-
SHA1
5cc9b4bfaedb573c67331f5a2d3d3fdb8d52f5cc
-
SHA256
c43bfc818576410b24716620364bdd47e7a5c5f70a536b245e3c1e0d581f3d5d
-
SHA512
9314ca717f839bc69969fd5cefabfcc72cb729e856c89e2bdfc74c583e834216a00d5ae8de2437d4c0aef008afbfbb7c874531ed671c492a4d39101888fc63a0
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNRszOt:Dv8IRRdsxq1DjJcqf0t
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7f1cea428dcdd38bf0f5debf51f93a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a7f1cea428dcdd38bf0f5debf51f93a4_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
1KB
MD595d02aa8c1695e2b95331bae10bbddb7
SHA14b866335d17ba1a2e4b2ffddf07ded2217111a49
SHA2568d451a8821ff670506c4f5809fc8ae5b4a400be237a3bb1d5f40574410945e7a
SHA512987f46562a58868d2707b239a3c0348da20a09052c70497495b4ddf13e9ea621aaa24e936b23d668fd06d1a7a9c1acfb64377a628bc4abc3f74b743cf73410e0
-
Filesize
28KB
MD5c21918b9aa99b2c24992fc6bf963b1b7
SHA185eae36f3e013f6d68956a51b76e738c03af3f38
SHA256ce3ffd8e41d3b237f13809d1071c4f87c0c6aae0bb250c3f781bc1f5569b4e9a
SHA512b0e666bdf5048b8cc2df0d57dd0240d1a21ea4157584bd7f949862641da2060aaa4d3b27ad48f0d3375b62331e96163ae8d6a8edfb2d9013b20d632bb6c72628
-
Filesize
1KB
MD54887af38be44b8f5ef95ef193ba4e2b3
SHA1ef215a65b95d3ff842a906ba64253d48b3714bae
SHA256cd53c8edd940f0c3a240191e149c5d7ed91ada4402533f7bf90d8142b2a54759
SHA512431a8efa370f7ce1545d14a1ba82775b874014b424760b6fa1e4a8a9573d33121a74c11d67e3e92259c2d82afc2b8fe78426098f2a269db002ec05185943d7e3
-
Filesize
1KB
MD518e5df229b6b59d2bd9c4d5559e839ee
SHA120073649e8778f947db80bef3b6ee0fee83059ed
SHA256594ab2d8f941b8c3e4387257bfa99a9a3c2db571520691355dd6e2e897872528
SHA512da1da59e450a551ad84bea27a299ad57e49353a1931db5940df51ceed94083f1ec1b6e9585a5a9da8d2a1ed629a2eff3dd397d29b606a6c587c2b8a609145fd6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB