Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-12-2024 02:16
General
-
Target
dc8deefc2b28853a38bbf255f4a48b9c_JaffaCakes118.exe
-
Size
28KB
-
MD5
dc8deefc2b28853a38bbf255f4a48b9c
-
SHA1
3e4add02f1ef6b99360afb18d08786401fce893b
-
SHA256
7505a79ff578309571a0fa1fcd0a44991c5f8ebbf7550410638bc763aeab91dd
-
SHA512
e6f73e1f08fa102b714c930ac5e8518da200407c4ca2e64fd83da137389206d33058b08ffc5386a38039297e496a34f5d2e1554d7c6d53b7783bd1cd0bdbc90a
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNqJM:Dv8IRRdsxq1DjJcqfPM
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8deefc2b28853a38bbf255f4a48b9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc8deefc2b28853a38bbf255f4a48b9c_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5db51dfe01966696a3398853dc901981c
SHA1e6986cf70ea766fb52570b3f4b27c1d55e65f760
SHA2569931e91e303e64c6067427a2bdb2392d4288aef1b5bafb6ecbe5382b111d2a76
SHA512652cb823fb862804e6ab7d6460fd7ed5b434e546eb86cb5fe23337ac48d8941d77cf147fa0a3c413fd39a5d9b05d5a38e8c2e8bb37efeda283f1bcfacaff6d54
-
Filesize
1KB
MD51beb29097d9182a392796f043163373d
SHA18e38be080a4a27b44058dea3fb4dcdc6e042962b
SHA25602535450b1cb167de63736125d9d2c4d060ff17dcf0b7d6ab092bb0a4ca95af0
SHA51251e20920f40683d5d193bc67b30881f61f2b3e8b8b0f6fd53e1132252146dc736e36f6e201085385717c8a1b1f5bd256e9aa4485b65de22dd9c98b847a15b43a
-
Filesize
1KB
MD589778b65c55a65048eb43948e3f85a75
SHA1166e13d56d4510aaf3e966de4c359f290e682f5c
SHA2563e769f25bfc37934f19fd8c5a10a100ce0ef9b30ff981ba187d409a49cbf9849
SHA512238b8a3a36244548dff2234b2b63d7d26f64f235436a8d1c34a47a27ab150db01102c511bb7b2d96b14733fc91b9888ffc8bd94e88490f46281a59b5d00de924
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB