Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2024 17:38

General

  • Target

    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe

  • Size

    47KB

  • MD5

    dac43836cf2c5fb9714eadeb7b6a8001

  • SHA1

    31aef0e1d792d3ad2e4c995f08f45ad58a5328ec

  • SHA256

    ec64b923e55b060537e21f5ac85525efe1268351e03cf420c4974a5609687b71

  • SHA512

    42b126689eb3c426c937b560415327675dd86558acd5c227b4d24034402babafb38cfe2a0d786ea0f62ed78f23135a6fe9de539b68112e1c253c0ea219774401

  • SSDEEP

    768:nqQ07c92/EyTAYtxqfGNC0klI7C8ycYlI5P194jp4W/ap+/bZ:n87wc1aGNC0klI7CPpIFa6EocV

Malware Config

Signatures

  • Detects MyDoom family 3 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:1312

Network

  • flag-us
    DNS
    resources.jar
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    resources.jar
    IN MX
    Response
  • flag-us
    DNS
    resources.jar
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    resources.jar
    IN MX
    Response
  • flag-us
    DNS
    mx.resources.jar
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.resources.jar
    IN A
    Response
  • flag-us
    DNS
    mail.resources.jar
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.resources.jar
    IN A
    Response
  • flag-us
    DNS
    smtp.resources.jar
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.resources.jar
    IN A
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mozilla.org.xpi
    IN MX
    Response
  • flag-us
    DNS
    mx.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    mx.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mx.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    mail.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    mail.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    mail.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    smtp.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    smtp.mozilla.org.xpi
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    smtp.mozilla.org.xpi
    IN A
    Response
  • flag-us
    DNS
    unicode.org
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    unicode.org
    IN MX
    Response
    unicode.org
    IN MX
    alt1aspmxlgooglecom
    unicode.org
    IN MX
    alt3�0
    unicode.org
    IN MX
    alt4�0
    unicode.org
    IN MX
    alt2�0
    unicode.org
    IN MX
    �0
  • flag-us
    DNS
    alt1.aspmx.l.google.com
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    alt1.aspmx.l.google.com
    IN A
    Response
    alt1.aspmx.l.google.com
    IN A
    142.250.150.26
  • 192.168.0.91:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 192.168.1.56:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 15.244.196.178:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 15.237.41.41:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 15.28.205.95:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 172.16.2.250:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 172.20.181.2:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    152 B
    3
  • 15.253.24.176:1042
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    52 B
    1
  • 142.250.150.26:25
    alt1.aspmx.l.google.com
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    52 B
    1
  • 8.8.8.8:53
    resources.jar
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    59 B
    134 B
    1
    1

    DNS Request

    resources.jar

  • 8.8.8.8:53
    resources.jar
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    59 B
    134 B
    1
    1

    DNS Request

    resources.jar

  • 8.8.8.8:53
    mx.resources.jar
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    62 B
    137 B
    1
    1

    DNS Request

    mx.resources.jar

  • 8.8.8.8:53
    mail.resources.jar
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    64 B
    139 B
    1
    1

    DNS Request

    mail.resources.jar

  • 8.8.8.8:53
    smtp.resources.jar
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    64 B
    139 B
    1
    1

    DNS Request

    smtp.resources.jar

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    61 B
    136 B
    1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    61 B
    136 B
    1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    61 B
    136 B
    1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    61 B
    136 B
    1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    61 B
    136 B
    1
    1

    DNS Request

    mozilla.org.xpi

  • 8.8.8.8:53
    mx.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    64 B
    139 B
    1
    1

    DNS Request

    mx.mozilla.org.xpi

  • 8.8.8.8:53
    mx.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    64 B
    139 B
    1
    1

    DNS Request

    mx.mozilla.org.xpi

  • 8.8.8.8:53
    mail.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    66 B
    141 B
    1
    1

    DNS Request

    mail.mozilla.org.xpi

  • 8.8.8.8:53
    mail.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    66 B
    141 B
    1
    1

    DNS Request

    mail.mozilla.org.xpi

  • 8.8.8.8:53
    smtp.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    66 B
    141 B
    1
    1

    DNS Request

    smtp.mozilla.org.xpi

  • 8.8.8.8:53
    smtp.mozilla.org.xpi
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    66 B
    141 B
    1
    1

    DNS Request

    smtp.mozilla.org.xpi

  • 8.8.8.8:53
    unicode.org
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    57 B
    175 B
    1
    1

    DNS Request

    unicode.org

  • 8.8.8.8:53
    alt1.aspmx.l.google.com
    dns
    dac43836cf2c5fb9714eadeb7b6a8001_JaffaCakes118.exe
    69 B
    85 B
    1
    1

    DNS Request

    alt1.aspmx.l.google.com

    DNS Response

    142.250.150.26

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Harry Potter.exe

    Filesize

    47KB

    MD5

    dac43836cf2c5fb9714eadeb7b6a8001

    SHA1

    31aef0e1d792d3ad2e4c995f08f45ad58a5328ec

    SHA256

    ec64b923e55b060537e21f5ac85525efe1268351e03cf420c4974a5609687b71

    SHA512

    42b126689eb3c426c937b560415327675dd86558acd5c227b4d24034402babafb38cfe2a0d786ea0f62ed78f23135a6fe9de539b68112e1c253c0ea219774401

  • memory/1312-0-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

  • memory/1312-3-0x0000000000800000-0x000000000080D000-memory.dmp

    Filesize

    52KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.