Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
01-01-2025 13:16
General
-
Target
JaffaCakes118_56912173920bcdaf45c0ba0f1410d2f7.exe
-
Size
28KB
-
MD5
56912173920bcdaf45c0ba0f1410d2f7
-
SHA1
edaa5e9d5a16ba6bcae2a1745eb36ac3009bc42b
-
SHA256
a7b1ed850664cdefa4bb5e74eb1406483d38e4079994daf4ecddb202d41efef1
-
SHA512
6980963b2b6f92489ba87e76d0120d5814dff0901a06f11f24dfea3599156bc28ec16467cc9cb70f05e5da0748885a2261ed76ded2da114fd486d13163e3af3e
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNfLvO:Dv8IRRdsxq1DjJcqfYL2
Malware Config
Signatures
-
Detects MyDoom family 7 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_56912173920bcdaf45c0ba0f1410d2f7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_56912173920bcdaf45c0ba0f1410d2f7.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD55a3b26788cc9630eab5848e3d4413755
SHA13cb5e220d15d88313f430f520beb236d8f3ba271
SHA25674223f91d6dfd55e2df77703a7f50cf4ab238bed4af1a4e3b854f28b80a277f7
SHA512da72cb3489d30753a6826fbba65a59494a1f173ba445733dc8eecb7813086ab46594edbe9dc302b560e927a03c30b8b28b7bb388b70025295ccb3d71fce7db4e
-
Filesize
1KB
MD5d96cf7734b56a2ae82199d547ebb3311
SHA16f922457014d60870202de62fd7128ced4d2ba4b
SHA256ac645b8568b27ce924ef51540c37daa892e5ddcce6c9cada4c958ba4c4dfb9a6
SHA512f03b82f3f2465668acc005ec31fcdd1e9444b646b3883c7ba133625f489db3bbb55cfcb9dd6f3b9b2e4d884f3818f79d2bd378317fc437d46f4bbce0b2369538
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB