Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
06-12-2024 22:51
General
-
Target
cf6ee881939348bd1dddeff48237a072_JaffaCakes118.exe
-
Size
28KB
-
MD5
cf6ee881939348bd1dddeff48237a072
-
SHA1
110ccbbe7512cd8bd7e7be3d7f5eb6c7f2354d60
-
SHA256
534ca909d229c3ebc4e515e7aaa6f34f61de18723815c00e6be9db9f6af6fb9b
-
SHA512
9511e09dfcad4e58fad7f7f7be10f113871c31577373c3e507774d239be9748035f1fc03c8fa88620a7e497e05179afff46ed5f4906c0a5bfb1a5bc450deb0da
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNAIz:Dv8IRRdsxq1DjJcqfe
Malware Config
Signatures
-
Detects MyDoom family 4 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf6ee881939348bd1dddeff48237a072_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cf6ee881939348bd1dddeff48237a072_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5944add72636eba21281056fa40ea29
SHA15f9939a90e704bbcd29a4c6d78fd582d51510372
SHA256f19ef72a3ec9df5b2a7b88d7dbf4065cd5095e54e96d25dc3846c08e5322c0fc
SHA512debd69c6206cb9d5de1b38701e15af3dd24403b360226ee2e6f6f5aa26596ea557140f01fa6bd1a6f70cca553c8bd046f7a17b9801e6f3aa9047b1553272ebc4
-
Filesize
28KB
MD5234b2ed8d47546956a124b1f70e51e02
SHA1edcf89b9ba35b7114ea3fddff825b2cd2e5296ab
SHA25629777fcc19dff35b3ebf2076c5c110cc3fb2bec29727201aafd3569e2680c8e9
SHA51221f8eea96572a297447e34262706e7959ba5ff1c57ed9eeb7f61bf7fbb0e4293338cf5d2e3a95a7b2ae91a30eff584de79e33b81ff7e0283d288dc46bf9b09b3
-
Filesize
1KB
MD5c64ea4500202c731198bc8c8d9e6c6bf
SHA18a04038ca1b23dd2a88b8545753ddd49e545cafb
SHA25609fa0e0b6a32b4a8b676ceff8ddeeaded4fb66bdaa86fb586a3c6226b74504aa
SHA512247b807336120b1c6da09b3cda30d25ecf532d3dbd7452283f829a96ab4e5f43c0ce9ea0cd6b5412d0497a5de11ed31374dfb8eb08c66464ba46afe4409e148d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB