Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2024 13:11

General

  • Target

    e19e36dfd33a19eaa04b72f455e27e09_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    e19e36dfd33a19eaa04b72f455e27e09

  • SHA1

    19beecb6feb9730dc72e635cda6d5979bf7d64c4

  • SHA256

    4475c5093dd95b969055dfa5a6602ab36c5019e5f3cc2218a55c384309505de4

  • SHA512

    47f8882cdd874e15c939e4e47d0f92de3a68cb5617efabb8af394d3932c5b5af98c97659b6cc047845edf8007c46c1a6b8ce163a6570012ceb8dcb28562601ac

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNNtTxIHUOK:Dv8IRRdsxq1DjJcqf6tOHPK

Malware Config

Signatures

  • Detects MyDoom family 9 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e19e36dfd33a19eaa04b72f455e27e09_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e19e36dfd33a19eaa04b72f455e27e09_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7ad7db01e8692749c65d821fabb5a30

    SHA1

    3698238c2c2484cfa7ec104586f91fe66d63dd84

    SHA256

    3d75f25acc3f840cbea143020ecc3b9d2816ab878b0a5c04859863e6c59e17e5

    SHA512

    745e0bc6bc95773deb0409651f5ccd35350712c14535b629005a0d64fe28aee611e5deb9036fb48332623326693d449369bee2404e604812c2ba03b4dd1f2dc2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\default[5].htm

    Filesize

    315B

    MD5

    14b82aec966e8e370a28053db081f4e9

    SHA1

    a0f30ebbdb4c69947d3bd41fa63ec4929dddd649

    SHA256

    202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf

    SHA512

    ec04f1d86137dc4d75a47ba47bb2f2c912115372fa000cf986d13a04121aae9974011aa716c7da3893114e0d5d0e2fb680a6c2fd40a1f93f0e0bfd6fd625dfa7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\search[3].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8B420DKQ\default[6].htm

    Filesize

    306B

    MD5

    025f7170b4e8923cc39952474f2c9fb5

    SHA1

    2fe7ac0a9376aade5192f62b69333bc3df7a3d1f

    SHA256

    6cced99f63e90c81238b17e10657b74ab2e88ab76c2549d073933b967c58c948

    SHA512

    4016221fcb6fc1b9c5a4dcbd6edf8c980001b35266ed9f0941802e9e00043a94009f36a6a3da6acf6c9733f5a0347468e4e86c5351fc27d62af44d9381e9d497

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\default[1].htm

    Filesize

    306B

    MD5

    e0c3b4c8541e5bc3cf19d22ccf8365d6

    SHA1

    9ac1347e4dbce09ddacc47ff46b9cb15b01fd77d

    SHA256

    69e3c690688497ac57963720235b9181d6ab79161289aed6bc518f2284e75696

    SHA512

    3c6a7bb5b195dd5e973d180f051ad4979d37bfaa489e6e22c239a2efc007a203c72732496d0db1324a16344606510cba911af242337bd96da4f9832c9f6552aa

  • C:\Users\Admin\AppData\Local\Temp\CabF292.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF2F3.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\tmpF4EC.tmp

    Filesize

    28KB

    MD5

    b38c4e6de0ad32e0b7affd3de7644892

    SHA1

    8848d9850d44f871ab5e1be1bf23652bdb5495e8

    SHA256

    f78e7f04714aba652af6f91b07b94cbff4b5968e715d9abc9a6ff6a5706ce748

    SHA512

    a3118fc3667dff6a81cb486272f780b45358a12d764931f9fdd29a4f91331ebf2606ae804598ddd941a8e19081b7f18216df3e7c35767df6f66ee366d3ce64a0

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    1635f0dea954f544b1ac1fdd6b9079a9

    SHA1

    8955ebb9aae5e6ad6d293cb8860b943cc32b50c4

    SHA256

    3771aa60f6412611523ec33d9c38083053973a8ac267079e2d1e94201ed62615

    SHA512

    372a9fd87c453291095e5101042e2c3ee2fb1acdc8a2bffb202269db20711663882c1ba8bdf87d444e8018b087194679a14006ff6950dd5b40d7ed0d07f440a6

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    303a860e4afbfda849ba77c661a61de1

    SHA1

    c011dac20772ba7eb84327534fbdfef20aefd7e5

    SHA256

    ce85244a38478e17aac67748828f3dda2c0d37d931fb47f8c5c979bea65d04a8

    SHA512

    4a708314869015bdc5f5c7c06af9f602493d7a2ccf9d1ba89bae1cbb1b6fa4fcba5b0f1744fd1936d1e78acb9062a1143db93e462bc8070b70bc96bde5887410

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2176-30-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-77-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-32-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-345-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-58-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-270-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-60-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-19-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-65-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-70-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-20-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-72-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-37-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-147-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2176-25-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2188-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-71-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-64-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-112-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-17-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/2188-269-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-59-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-344-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-57-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-31-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2188-4-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB