Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 00:55
General
-
Target
JaffaCakes118_61add7b5d18514727caaa38c7052959a.exe
-
Size
28KB
-
MD5
61add7b5d18514727caaa38c7052959a
-
SHA1
5b7839fd865ddb49baaf9be65a9fc6a5572a7250
-
SHA256
742003393c83f954466b0b77a5de105e7d2821cea5cb958fd3cc92f347af067c
-
SHA512
f1d2b3cc9459e53d5a2516d4fe38aae90b30fbab09c97a1e5a422f080b5cdd80648fe5baa65f588cfc6c1e81ce4c6da99e1df55902a1219a4437ed70b57f2a06
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNXWrG:Dv8IRRdsxq1DjJcqfwKG
Malware Config
Signatures
-
Detects MyDoom family 12 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61add7b5d18514727caaa38c7052959a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_61add7b5d18514727caaa38c7052959a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5e5c2364375c0a8a786a9508a840b6299
SHA1bec1874db0d2348274b6656d1383e262f73e2bc6
SHA25651b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3
SHA512ee19a8fa40bc7e991ac289eb30ceec8264d6071f124e99791022961c99f25b97def4f13fa96149eb52786d1104d85d20410e65a333304c0df6ba858472a557d3
-
Filesize
304B
MD5267ddfdbb8d492b25de208d84b290f1c
SHA19f57d9f19f25549e1232489a0c101a92e851de2f
SHA256ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
SHA5120709aa62d39d419d335183235dcf328e1dfe6997bd9bfbdeb01bb050df8dcab63ec2d4f46e4718ab389fa8e12af66dec2e3019c8871ac6e40927a25cb706c6b3
-
Filesize
310B
MD52a8026547dafd0504845f41881ed3ab4
SHA1bedb776ce5eb9d61e602562a926d0fe182d499db
SHA256231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
SHA5121f6fa43fc0cf5cbdb22649a156f36914b2479a93d220bf0e23a32c086da46dd37e8f3a789e7a405abef0782e7b3151087d253c63c6cefcad10fd47c699fbcf97
-
Filesize
305B
MD5157431349a057954f4227efc1383ecad
SHA169ccc939e6b36aa1fabb96ad999540a5ab118c48
SHA2568553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
SHA5126405adcfa81b53980f448c489c1d13506d874d839925bffe5826479105cbf5ba194a7bdb93095585441c79c58de42f1dab1138b3d561011dc60f4b66d11e9284
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
313B
MD5ffb72ab4faba49ad441ce07db37dd8b6
SHA1194e13c1c32ebb6e7a1dc912261cbd58a82ff71e
SHA2567bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
SHA512517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD568877a1018d80a745497e71ec391fcf2
SHA1636f97d7cdd3c52140688118b2f34096a9f9e291
SHA256faced1c0306c266fba46ca4c8bb3b2948f9777632d34f62eddb3f9ef3b7ebe8a
SHA512012624189ab39529fe15a71615959ec9ca2b3ce830086f022dc30b53eb58ecc8772f88a6eb33726f714e343f3464e46053d0aa80a00ad56fa4c9337fd272384f
-
Filesize
1KB
MD55eb18437dd33d5b28917a132029e37bb
SHA18f6931311dd95c01b11e88db95623453041b6f22
SHA256ad292b674c7162d64fff13d43b6fe8694c798115a822f9147ea09e3dbf59eb19
SHA512490993caaba65e3024ef4ac59df1cc0890d9eca5f198b67df83a06741f7940055574d80ba63cebe7802eb2b56feb355586bcbcaf5a4f698c6d9b4ca05c75dfc4
-
Filesize
1KB
MD5d6609e012595848ca8794a5f6a3138f2
SHA10922e3d179742cb827bb91d1f74579de7270d07c
SHA256d18b4fd200861b5569bbe07b83e8c408925d4aa5d91c4fddc42dae4d14ce9059
SHA5120ca28919533c98e8bc3d0150ca76a339382d4fc722536356bad1cb1a1d56d16e6de2d64ae860f5495671b89ad360622c73f7ed87dad9ce3df8c8e7b12e44a721
-
Filesize
1KB
MD59a5e7775c3b142f86940154c7b54a70a
SHA16b2ad5e4b31ac54d60f3cab75c0638ef3cad0c48
SHA256d00603fb77404c4a81fd699a5718eb7cfaa410c283c8f831e7a8da9967e2b1fe
SHA512b6f66a207e6e117f8fd1b3ef9fc55ff519e42171bbacc049ff856e194d13a60380089e4ca657bcfc0496778344709b7ed453e9715eecb522f0c405a5cf643768
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB