Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 15:00
General
-
Target
fc02c43f26875c28530564579e85a0ae_JaffaCakes118.exe
-
Size
28KB
-
MD5
fc02c43f26875c28530564579e85a0ae
-
SHA1
740491b3292f67b3a239caec453de3f639b92094
-
SHA256
e45fa084ac06a8baf52d3074e4ff9fe3933975719dda23a9f4dcc53fa593f00e
-
SHA512
571313695a64e1c275c2715ef6b54581996fca82043d93e2de742e3b2fbaa9fd2790994edc1dec3b8ece6496c2f25f91f8c309861ebf8eea7c52c02d9c039fa2
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNv3Z8:Dv8IRRdsxq1DjJcqfU+
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc02c43f26875c28530564579e85a0ae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc02c43f26875c28530564579e85a0ae_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD57b11efe74b514914e0a3eeb13a17ec2c
SHA1bed684edf26a667d018436809e1ba21f2d640140
SHA2563f6de3fd499f82ed32d5981c346a10d59df714d3294ab9b282741087a88b081d
SHA51262c3ac1a92e2cb632c70cc67ec66abe184214ea1e823be0ea56cb673bffd4c167d0327df47a080fc570c745b07f8e2044a13c9d65ba6a169109dfa9ad0077256
-
Filesize
28KB
MD54971e5f1bd91a564bb676ae6e1868c58
SHA1a269ec0824b5cb5f5a5fadb45bf6ef1c9bbebf20
SHA256caf7d53937a11bf2a617fd7ca3b7b9b5472498e878380cea0b402ed2a0dc6a94
SHA5126fd3b3c0d8fb1288b60aadcc274b5722019f4893a357b1a9770f3dd0661de9b625f0811ab33ca2fccfa2011b66461f257e431189abf33f21c03815a1c1b3b297
-
Filesize
1KB
MD5bed185ead79ddf450ea7b9902bd3724a
SHA1c670c55a45ffe5041022e58ded4a6083716720a7
SHA256924ab444bdca1d7e2495e0ec17fe52a6425290983353e827f774a4beee8d832d
SHA51236d86f31f7d32c6d3a1491e46a02342270cf859b05c32a04f8b42b05170becc54b9d1424d37f878763967d8f111b67cc4e5fa764012371d31f477cef5af433ed
-
Filesize
1KB
MD506535f7819fefac68d254925b4f79f18
SHA15dfe3fbdab7542da086b4b88dc9496e34e50acd5
SHA25671d3a42a62b9b98217049aafdab5a3aece01abbf7b069f9ab1064dbd8ee880e5
SHA51242d08bc6c9b0b10321c3fb83355c93420dbf97ee719f585f2c01588f477f2dcc511ca437d30ea2c63c13b1128ec0bc58f3b2c82b3a29f1d05a24cbc232b58c36
-
Filesize
1KB
MD5a2e7bfad90dae2e102a980d7d8f2570e
SHA1131f5be49f0e81ab8aa0c7304b64d0175a023066
SHA256a9e2338014a22726631061c0c091f48046fa998bfddd622c11000f81ca8a9728
SHA51202702b9bf888c299d110302eb81ad6fe7e46d1d9300b48dae1ee745c84caf6f0459d0a51d20f91d0abf2c3cc3a4d9bf7b80821bdb0ac0b66a931fde76b4045b6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB