Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 12:02
Behavioral task
behavioral1
Sample
eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe
-
Size
28KB
-
MD5
eb697513a9cf064cd3c291170ace84ca
-
SHA1
a143157c614d8bdbe1b6e52b309aa1cd1533998e
-
SHA256
a73c8cb002fea80113c16baca62a80f91b30a34cddf0980ceeb233c2930d239a
-
SHA512
d55d68b7778e7c5125c7994c7f9388f47df0ec76413f3ceb842fe123fef9206b5c315e3c288e7fd3a06690d6807eaa26f1d04a1721f11f1a52cb07525a890350
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN0QbPxk:Dv8IRRdsxq1DjJcqf7KZk
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
resource yara_rule behavioral2/memory/4532-13-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-44-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-118-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-229-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-233-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-240-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral2/memory/4532-308-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 1 IoCs
pid Process 4124 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral2/memory/4532-0-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/files/0x0009000000023c98-4.dat upx behavioral2/memory/4124-5-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-13-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-15-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-16-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-28-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-33-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-40-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-44-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-45-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/files/0x000d0000000219e5-55.dat upx behavioral2/memory/4532-118-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-119-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-229-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-230-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-233-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-234-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4124-239-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-240-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-241-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4532-308-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/4124-309-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe File opened for modification C:\Windows\java.exe eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe File created C:\Windows\java.exe eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4532 wrote to memory of 4124 4532 eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe 83 PID 4532 wrote to memory of 4124 4532 eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe 83 PID 4532 wrote to memory of 4124 4532 eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb697513a9cf064cd3c291170ace84ca_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
162KB
MD5395e8eb9b8e8e7925a3ab88b3170d00c
SHA16b786e96600723d1777cc8ad0371d477108c5813
SHA256e4d1146e8cdc7bd6b68f271b51f3980b33dd75424fb36d7074d95400b3730b3e
SHA5123136fa61ec4e974b7a95aad425c189245dc9bab497d6599182f909fec1d758717359937ddd73ade1ef8913f5e8f36af3472c735dbed8db86f0e444dc9c1277fd
-
Filesize
1KB
MD53b29ebb799648bd7fa9d4bfe874c24e4
SHA12705dbad0fbbffa4107b00dbb53b694c3b26ea53
SHA256aee2140a628c44ce8b6b4e1c955e18178a420d41b5285c6477816d79918cdc61
SHA512005749173526b902ff60d02b3b0e9ea5df0cf78b980b7321d45edfd6b2e9230775fa5c4a11b65439bfd2d120b40fe9227bbe89a6e8588033d83de0d0a73507b0
-
Filesize
116KB
MD5e03f9a5fbfd761aafc9002d54137d261
SHA1bd7d5e2775b48d77a3aafca145827fd8ba5455be
SHA2566fe2292367b029b44d7616156d68ca231e94a8f11e7ae0408c520134b626a9fe
SHA5126564e8b957e0f714b4a8c78e8a360516ba2d21c5d9e67b2277fb634cd7c656337c69d2f03fef62694d315f05117a9beff2d96807314b1bb12595175182da7a9a
-
Filesize
162KB
MD5f15c090857c64eaa1aeffe97ba51acdb
SHA133e4f4060ed17a64951aee0ec59e4a77a4a0fdf3
SHA256832db8e05693d004a908789389022361807cec66283d91c962a6b8a11bbe10d5
SHA512f75be5724a327f3652b4ebce2840ea3412688cda3a7a466b3ef02bace2ecdeb8667e6475a5d1c5f3e7bd7ccf15a940ee1084d764c2d5e0cafbd79c7172badeea
-
Filesize
28KB
MD52633644b2a1db3f4e3eca2506fea44ea
SHA1d8a491c7a23617fc2910a66ff657a442c934f320
SHA25603f01f3f9af5babf7436354f4b9a89d356dc8f08a4d9f01393deff8e522fb856
SHA512fa3e3fb11be1107a8e40df61a2c9b2e488e7cb3357622af0eac0aed23654b119c755bf436b6d7b1ee896a610c268f1cfc4bd9e9d484075077fa4a896c1220d03
-
Filesize
1KB
MD570c799cc4e337e59c6501c9c5624eb0e
SHA196b44ae991e4c779f1a52a3bd6050867ba458362
SHA256a0efcf4c0e18458549b8b7195121e6c5769920b3be84219f7949f5c24195c57e
SHA512fe00d145186b6a25efffe4242484b75d52f6739ff568c5f51036218e7366b187584274bc8745421ef242b5d09ce5cd12e6f50d0e2a783053f3b5c1bf2e9c495f
-
Filesize
1KB
MD5c948d0aaf5c188a731d243795966553f
SHA161accb1602057c9c0db40b3264b8fcc5a9e2732f
SHA2562f72d4d989915003c1723339887ffac22df71cf8643e141fba22c3cab04f5212
SHA512f7afc1304f1a18df811595ed40b39887432e804e59e2c03d656bd6fd00e9426a9245e7c8e4e7b78195adb6de9c0d1dbc9f56264ff22c0fe664c790f516827fae
-
Filesize
1KB
MD53aaab8be0569d1b2346ebbf6df468581
SHA1ca3091d224b3975643b85d3d5767a5b8aa15d915
SHA2563b67dbf72d8e59b291d9a65f065d4339b19faa658603ed0cafc031e5923c34de
SHA512520c09733b86b56a1fe9f778bc0980a87d7449f3b2df7fe975b42d619b46d9dd185f4d9c3e2b8678f02f389f39e41e26e9edd957c7e4c038d9330b0d9b8c381b
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2