Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
03-01-2025 03:11
General
-
Target
JaffaCakes118_69e0c62a837b33f7c3ed6dda12fef8b2.exe
-
Size
28KB
-
MD5
69e0c62a837b33f7c3ed6dda12fef8b2
-
SHA1
471659f4aebd43a9b3fe2ffd8fc2f93a68bb217c
-
SHA256
dd8d17c058b7c54a302b96aa9d35380bbf3a15c61fd2620c7a2d6469efe23b8d
-
SHA512
ee211f4161adb589a79c40423273266212c715bda53c0354b6b1252077b453eaabe31dcab76ea9524c6078bf389b89adde0a26cf30919775742677b4f0e111a3
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN8xkoa:Dv8IRRdsxq1DjJcqfPeN
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69e0c62a837b33f7c3ed6dda12fef8b2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69e0c62a837b33f7c3ed6dda12fef8b2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD52522bfe57a08e657ca00678f77ea8a2e
SHA14d5fede68361a409dade5d32c119ac7c8b576eb7
SHA256e26e8cf36bbe7dfa9ac92d844f1d84ba55c3259e94cfe18b607043231fe26864
SHA512c433d9bdbbd8e5d8913551de5cffcf3454aaade224293c7a2528e7956edc018b84ade4ea7b034a5720e3f6577085c612a659cee99ee5f12e0da97683f02a5ecb
-
Filesize
1KB
MD55b5d27b3b75bafe82bd6b477506e45bb
SHA1aca5f03b46b658a8276c6e2e44bb7498db0809cb
SHA2564fed16cd5198db184ca2cd6fab29c757f5f6498144384453d9b9f83734affb55
SHA5127aa7bc54ed6485c598d546c5c1f3e3e07e90961c424bcb266e98d229a8a3bf5758e0b2d1d6b8afc158aece6bdebefe4195f57188173870c7b8abf4fd7df6d4e2
-
Filesize
1KB
MD518759391cc463d7eed5b6483fe5be3cf
SHA115e6af04a2525ab2c8814dfd9fdcd55d67c56335
SHA256b043231fc8cb46e37f166e8015bb6958fb4840eb6548a504ace5878b041d79ca
SHA512f9843cb18e1ae761770201a94265b983b950e1a76c4197eab1de0544f976bf44e6d976971e7868869f966bbc917e47d7ae82ffba21dc14c028b07c98d9abbe69
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB