Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-01-2025 07:43
General
-
Target
JaffaCakes118_6395686fecfd8d08713842e86267db50.exe
-
Size
28KB
-
MD5
6395686fecfd8d08713842e86267db50
-
SHA1
971e7824d2c5498f03f59cd69d60fbac4c8ab9a1
-
SHA256
24549252ed0a726a79b0e75fa02e3e61e13c189b085d2f87dc606ceed95062ac
-
SHA512
b9d3322e910b009ecabef979da45eb6a3aa0764eb663ea19205faca1378418974f97b379d91ffc98d9518d72a5e83ad1eaca1809108e6204adcc2f177657102f
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN0zhKGfp:Dv8IRRdsxq1DjJcqfJzz
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6395686fecfd8d08713842e86267db50.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6395686fecfd8d08713842e86267db50.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD52f62d28613ed2342d77feaded613346e
SHA1e0e68282bd9f296d330be809a443375d126975e3
SHA2564cdcf60eef3697363b1986f77bee3e257ae14280e07689e53c2bf05556d8a178
SHA512dd5c42a56801caf0b8f20fbe6d51eab9db29c7fc8576c86ab820831abab584167e2b4891be1ebaedb0b692c52b8280b8d3d121c6ecc099514db2d855340660b0
-
Filesize
1KB
MD5c04269f52d05f49f55119dde15b4c8c6
SHA1333a017d062c0b2f1b3bb6cdeafc7b16061a36c2
SHA25641f858e5866cee7b66a0ff89b6300319e35f980ac9318cb40be2457d41272215
SHA51237ac29a017e2fec58d6b214611c462745836e81771d67797274b4fbd86e4d68a15ab2f6b4b5463c14243e787da3d425d4c60e94a82172d884f48824ad4ee82d5
-
Filesize
1KB
MD52bfb604d7ef2025adc0f5f11fa10b61e
SHA1c6cee84cc1344e4fe9cd0bfef90a5eb02c543f40
SHA2567232c7fae3fa5ce5c3aaeba592d54faee154b22f74ca81c117919c8de71e0582
SHA5126fa76b503edb2aaf4f66ff6f0ec25b89add829695ccb8a25a41ee01409f02af8bff50ecf04592816193ea6e669576cc6dde983d90a64ec092e75a98b99be1568
-
Filesize
1KB
MD5def0dd4fae957ae22ae9bc40cc11dc0a
SHA1f02fce06d5a0a9d1ad52468d3b09d58ffeae234e
SHA256ee49e90dc8fffa4398cbc975317454e21e1e3a0cc09a9f1dcaca999bb600446f
SHA5124ae1a013eec61df26000d5286da5502598fd812ae6815d8c9e0e0dbdccb459e92c29825fd9621215258fa42d46a8535d60792c52abf1b95ecfda088fdd08b956
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB