Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-01-2025 04:36
General
-
Target
JaffaCakes118_476466fd065b0a0966639827880f62c6.exe
-
Size
28KB
-
MD5
476466fd065b0a0966639827880f62c6
-
SHA1
9eb9e0aedfeb8bb2feb91acca3adecc0480c6763
-
SHA256
11b52798843b1a23be633e63994e19aaa2bd74db6b3b54446418f5f7af069259
-
SHA512
984d7aca7185900177585aea8432fa2a0f911650f729eef3f75dc838fc4c745f71a46428d9dfeb102259fc4e91c5a64dd61b1b408840f2ff024385fcc3237ca7
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN2oQRO:Dv8IRRdsxq1DjJcqflc
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_476466fd065b0a0966639827880f62c6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_476466fd065b0a0966639827880f62c6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5079e928e0b9b2821da6220c0f86f7deb
SHA1f684ca1a4c4eef092350b66ea2cf04db4abc8b4d
SHA256e30500a7d19068dbeb7a65267e11a9655d2e662dcc32043cdb6adcc847b42bc7
SHA5124a3a42990d9147e1b311095f08e9cfd4e60b34cc59659d91e58a2929f91240bc74abba4f09a1d2d7d69a11422e5df0f38b360ce390a74ce1112e21e51e4495d2
-
Filesize
1KB
MD507eb6016523e0bceb91174e738f195bd
SHA13cb7d631505b45b347cd9c9843d2da1445162871
SHA2561ba852669627ba3dd6fb08eae9e42d91fa415d1a07ca2ffafcb258a7e2f1a8fd
SHA512fcba945b87db02f5b6221fdbae73a71ea5427d1e9f2f3c686c356dba8dfed7134727cfc886491c56d58889e1718c6658385fd47fafec8b691aa1e0d04136207d
-
Filesize
1KB
MD5590dbd5e25b51adcd351c7e11b8c2477
SHA194a8958eff851ed9f914afd8ae0f52f3a27a5142
SHA2569aa22649e7be0d0b100506178559e680abcbe4d643212c79bb2d369a2efb0dae
SHA512c74994e30d4246fafde83c60f162b4f3f445acfbe32a1239ff2e480c923513f3d979fc6eb0863f385f155475349c902206bbbc65b4a7eec3853cf1ecdfbaec62
-
Filesize
1KB
MD5ec6069ccd6b0d4219a7f3ce1581ce5d7
SHA149c49fbf8f588b0aa93e2b61bd1c25a7849c4a00
SHA2564141a10c246ff85728d3acc975c7b3a1c0fbfd3d14602708dbf4326cc1d414cc
SHA512779abd2d969c6667b849a9b1a2cd2f44c66e098fc60351669489dfce4fa9a79374c6d6e7137beb8c20e4f1ae9039c41cbbb7ad191251a80a82c51b67e335925e
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB