Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-12-2024 07:05
General
-
Target
f2d829a52467ede663428c66472126f7_JaffaCakes118.exe
-
Size
28KB
-
MD5
f2d829a52467ede663428c66472126f7
-
SHA1
391f150aa453e38be33d7c9bc74f1d0843441e82
-
SHA256
b9ed46e4298d425e2e8938bdc02ae0a826e80a4fcec5532643cd6049726464a7
-
SHA512
1aa3db508b2a60727476c99c35b552f02c37efa283810483fdd1482f46358857fa35e91d89a7d91816b666fd5d0b50cc4c0e6a83a5440ad66b73daa648df61cb
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNgSmv:Dv8IRRdsxq1DjJcqfzSmv
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2d829a52467ede663428c66472126f7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2d829a52467ede663428c66472126f7_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD513218b4fa13264ff048a16396e1cb64c
SHA15c21535838ff658414173459720016468facb539
SHA256a366b5a2fda9da8631b85ffc61c798ed68cfa2480279497e73b4a8e7ecd3c2c0
SHA5125b3d5b939a032d6f7704876b1dee5bb45789f4523d6b328c22337de4896027c7104b0b119e216f982bae2c4b78f20b281161a8b51113b932923cad693dd23b41
-
Filesize
1KB
MD594fdde215c20c79b5a4882d55f1894f9
SHA19a9eeed68843d298fc812a5c063006bc8de19916
SHA25604a906cd404a2491678e6fc3e8d253697d8d6d56e6e2a3c2f32ea07c62fe6a07
SHA5125163fbe8575b02200309715b2fde44324cb36cf63df3e5cf3ca0d7967c0f3ed8af6a8c16a33f01948de6d05e3c6577f182d0bac793d9114f9a23c0f538f4dff4
-
Filesize
1KB
MD5173104943874b22c95c2f29f2c0beb58
SHA1ab29aff995b59431ada5002716ee3ae30c0cd478
SHA256e3297b964e8081da4535b55bc0789721a3b932d3a219cc842996a6a82d9c9a1e
SHA512a81c122ad3588b6ec1a19b923af763aabf34b154b5e15d8879c1b9d90033ce2fb4e4d4ec58941874fdb5a3559ea075710464d014a8ef929922ee5ec13078852d
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB