Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-12-2024 16:39
General
-
Target
da8e852f97ad71142328fd5a8fad1c14_JaffaCakes118.exe
-
Size
28KB
-
MD5
da8e852f97ad71142328fd5a8fad1c14
-
SHA1
0de3c98a8ab698229dcc254a67ec508af533c6ea
-
SHA256
3444f4b9e91ee49dfab83b551128192d02d1040bb243e296aecba3406736e618
-
SHA512
f44f7be211d7ca76328e5272ebfa08624331a766f00c3c7341636e82be141656c89070a300029d21cd6c471911b01a8aa57fe808fd8d69b54215a3fd849fb93b
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNxFYlvKQ:Dv8IRRdsxq1DjJcqfeFYlvh
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\da8e852f97ad71142328fd5a8fad1c14_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\da8e852f97ad71142328fd5a8fad1c14_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310B
MD52a8026547dafd0504845f41881ed3ab4
SHA1bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA5121f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
311B
MD5215c230635335623c6b1bf5b3b84ae0e
SHA1a98de5bfab1eef2c02b4578e5d7fd3dcc1141481
SHA25626b9da0ba2f737d0a226ab6d5b934b0e519aeda10f497cd4738752761ccb7af1
SHA5125ddb80d7d4fd3d87865ea541098034cf216df76dc34bd41fca62f8c9a21218f1cac5d8a5554e2acc04a2b1ceaf839e5847d14c54f052c9eab43fec28936225da
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
28KB
MD599c7a29457bfaa46fc8ab6f16f878322
SHA13334db9e69c39648c7c7fbd13451713b71b9954d
SHA256f581477b464e0cf46694468711492dfcafd0707fa22a69f1de6290925d6d77a3
SHA512dcd84363621fb04b815f3909989617a16d3c72538a2a1b417ae72ece60f8aca766b6dff92fbe7ae5ed8b9d11fc63f029e92ee905620f0e9595ad2ce79c20f19a
-
Filesize
1KB
MD54e3008f5a9747d6317a851df54c40fd2
SHA1ead257f76481037acd9e7ec7a23e60435c98c6bd
SHA2569a74cca06a3544e877e5cfb04f8235d7825234b46aafc92a50051067589f377d
SHA512814a1c78f956169abe417156dd8590f3969b5cefc9d2a41c7ed430feaa4545c458614ec92659241f38ed3737dd206b48d2499382782349d1f71f2199ffc9e88f
-
Filesize
1KB
MD53ce2df1df72bb1b9fa503d2425740c4f
SHA16d07e0e4108d166ba8776dea1ff41bb2d82c416e
SHA2560cb22ffe27da3bac396de0be7ee1529dd0586d6df9a0f805dbabc09610a6f24a
SHA512dc5cd0d83536cdad12a93dff157f915bb053a618752a003f95dc10c314a7755900b928da18ec9b8edb6a5fd9696b883b1079bf870c8c98ef1970dc7a6d06591e
-
Filesize
1KB
MD50d71dec4174104529336bcd45460b424
SHA1605a7945aa06e56f178bcca2338f96945bafd350
SHA256a48bffa2830b1abe4b624136f5336dd1932dc41374b842103bd4565480fc0f47
SHA5126059b20928cbeff48e89caec8d1fad28528fdb962ab4a74d5b4c21b6e204176a4cb40d57438cc9723bb6eeb16a2c9b49a013e5b666e6506f789aa244531b2e82
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB