Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-12-2024 04:22
General
-
Target
f24516e2e02ab686e09717a81c107361_JaffaCakes118.exe
-
Size
28KB
-
MD5
f24516e2e02ab686e09717a81c107361
-
SHA1
381f0ebaaf5e6680003d3c2faff66435e75e70fa
-
SHA256
c425e7ac539d1829382242ccc5201c520cda3d3f219bd80241c5ddc5b355733e
-
SHA512
0e36547ba20883ffcf6475a54cda201190488701c248786e0691ca628952f8620a57fe859c900cb0d139777f0005e644b04f633d9dcee0bcc1821514bfdcb24b
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNrpjaCNgw:Dv8IRRdsxq1DjJcqf0jaK
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f24516e2e02ab686e09717a81c107361_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f24516e2e02ab686e09717a81c107361_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD52a55968359438d2ce4563f42586c53fa
SHA16400fe18e6fca8d2f5f712512f43a3dfa5a84215
SHA256666aa489521f6e30ea6c05ec59fd90a4d0e7fb717a1f7bacd118e22b417e5c13
SHA5125bdd578c2cde208ffbc10b991452075b90cea82c8a74e1258e9b358fbb0208a8414c04d2fc71b43a86aa9972502da0e6b197d430ea8748fd25ad6cec7bb0d2dc
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
1KB
MD55c3e89b4ada1e6716aa4a47e76c857fb
SHA1ec311d538ab214aa305503bb4672e9bb442136c2
SHA256f3d4030fea9d18fd3451ddfd72077e91cc3a56ece5a4005a14e9c75d10ebc302
SHA5127821e5868582bef4980002b74a4382b965869e532870f941f2007cfc0916d1410470f8e091634acfb47120a641fdf82684bf1e0b607216f44ed3b36acc1e2425
-
Filesize
28KB
MD564e255b72a9ca6e67b5a4beefc3bd3e7
SHA19d1dd652e7930188ca23d7b525eef815b41d2a90
SHA2562d44cd811fdc3aa389d082eb382802a69d0ab193bcc99d72a9876bdca5382553
SHA512b80b6071511b011270bab427090e97f89e4ab88edae08335f268772b3d8ca8b8ced42d4971469fcd1829ea54889267aca101cd540d0307e44a6ef348bd491708
-
Filesize
1KB
MD5e76a87e91203d7a8aa02e7acf9437ef0
SHA19bd2d54faed748de1760b86fa04fc052e760742b
SHA2561c2ad65551c4df116bcc2b6dc164099c66e66c56eaefd90d0ab0eb69ebe48c8a
SHA5124eedb79879dac7630941dc2d25d82d39002ff949e6eeb98693ce033cfc1cb9c611ec233424a742746b3c5c2e42b0b74bd02fe6fe6446bf53976854afee5800eb
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB