Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-01-2025 17:50
General
-
Target
JaffaCakes118_66fdc83e89d0fa55294e2c19b851fa74.exe
-
Size
28KB
-
MD5
66fdc83e89d0fa55294e2c19b851fa74
-
SHA1
6625574bb8f90c03c03ff46c78821ba02011c617
-
SHA256
17fadd38842cfbece374f2e8cbddb54ad0fd02e03d8b991038bf176e7cfa565e
-
SHA512
715bda6862564a973c9f2c89261d58c1cf36079a3327ec7e0013e646e2b714e96904a0fb0a57c26ed467fb31b4287d49545149d963eda6f5db0c3fcd46c70c7d
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNBJ7:Dv8IRRdsxq1DjJcqfK9
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fdc83e89d0fa55294e2c19b851fa74.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_66fdc83e89d0fa55294e2c19b851fa74.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5e47685376a33b584a3842809c889fa8b
SHA19d03da392287989851e80d3945d3eea313e2f5f9
SHA256add521bb8a1a08669ef3e2c75499118ab30030a3041891c46c9b65388016b014
SHA512585caab0970782c38e0b3958e5423ae700872a01193bcc2aff26a192accab35b841964827e4824052eddcf834f951326d8cd97040b4ada7ed6e9abfc6ddff0a1
-
Filesize
342B
MD500476fb82f7b6f8f29971300541fa494
SHA1e595a5cb0dd5efe6883ddec24f11332b1637fa7a
SHA25627a4b14185d6d35fdeacf8d373c3c40cdd25708461f560f4da57ddf012833215
SHA51273108d9adb1e120a7c822defce4f26c056892ae455fbf14bf9fe692cbcb44b165614c594ec0322bf72f9247c517746ed98ef7e0e478717d632fc23caf4e4aa19
-
Filesize
342B
MD5ce0a9c5a4e02d44d8f4b5364bd37a13f
SHA1b31006b92c4e94077f5324fb1c190145b1d77369
SHA256c5ec8f97931df6db00f389e0d6f66b37a5c774a820a567a823d78606632d1f78
SHA512d89da796e67c0da7fb0e422effda4dad14f7c2d8bfc78253a1dc6c0e82173c10331e4687f0661b1aff47ad0fa58e978e5aaf60bd3dc2bf348d3857479fbceec9
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
28KB
MD5ad1af8d11531c8cf93224549edf48c81
SHA11250ade8b2a4c14ba480588c24eb198d8d59fe76
SHA256ebae9461ef1d1c7b96c5adedd1f3dfacc6fb9a5ff168ef5a3b1150c11a92ef02
SHA512128ad8d5ca4df8da7ced3e8a44f9ce50c1480bd9cedceac1b761a8c05cbbe234eb1851edcaf10725560b4f58c12f3254a49fe92d144bbb490c09d6fa679d51c5
-
Filesize
1KB
MD53a110a28246fb49ef618e1bbcb6a5707
SHA105e410cd8250024dd30c24e0e91b66c7f8a59fd9
SHA256c791dcabbbb6e2f85d490f5f82fbcc933dba5f37922ff3b58d7c969caa19d0e2
SHA512743f1d57c7356a9f8ed33d053affab6f116f025293aff44d04b6b8bf69fb308586462189808a94d41d025652d35a28ba311fe8c7bd84eca58b2461eba6626add
-
Filesize
1KB
MD502ef10421df3399a9cdc40cb95da1e34
SHA1e788f882cb73757faa993079c9938ee713b899c4
SHA256d37d808afb80cfd0edd3fb937d05134d52f4e3fc358a9de335e1e7a9f9cc19e5
SHA5120014b65b88129d5042a96bf87f12861e4f0912e41926b97354691ec31cf3356e119d4ca234fc4b1b10c9c2e7dcd0fca3a3153371aaf69c1ac5fb993326040435
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB