Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 09:34
General
-
Target
JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe
-
Size
28KB
-
MD5
6bb2ad74445235481f930c85bf9c2e14
-
SHA1
d4942f52bfe858e0a09db6bbec04b6326e2a8a7a
-
SHA256
251d120ef93ad1386f54ad7ffe046037852341ee5b4f4c63b1f97479e551d9c6
-
SHA512
575d491ecdac681a1e77865a3583b4cf96ab14efb0281e70f60cdf8e1af5902cc10c8fe047fdd3d1de4fc7489d6cf4533e5db5e82c41431ead40c290a2ef0a5c
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNYpuzb+:Dv8IRRdsxq1DjJcqf3z
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bb2ad74445235481f930c85bf9c2e14.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5f8eb283921ca12b064f6f5573c8d8be7
SHA1f754f430ad81e68bf4877a7cc92e8774e25966b0
SHA2568a1d9686bc6f7fada95e246419dbc47d3961a4041d1c73987843e11a83355b35
SHA5129e3deb1c31cb91d40436b650a7d5136a2bd89b58f910fb9223fbc0aebdf8314ccdb2db19a00fbba6509f0698e740818c5a6574cb5ad04fa6e9a764db7d0d14ce
-
Filesize
1KB
MD5d42f0c29ee266ba1260c6ee3163e035a
SHA1287050e936754c43fa35f6fdb85654885fefc4ad
SHA256bb6bc91d520e0b70392cb1c3183ea9ad214943e3ba2bcd75c891d0ad484abbb4
SHA5120dcf59d82b2a46cf25ad460138889eb7fed63a219b4ce9a4f66916b4e983facb96c7da1f6a2102ac9004a01190dc0080a88b6c7ade2a2464ac9dc5227d5c0ca5
-
Filesize
1KB
MD536f3b9e657a60c29823f2e4f4e8171af
SHA1a974a5ce177a5e0d89f6e5d7fb80e6abcbe52741
SHA25647b60acf57378ae9d59b0bdab7a33b73982a7a7dac667162a330c8e5c0acf8db
SHA512365e47dbac18bbfc243c2ef9093ae4c291587ac009516edbfbacf0c7971655a87e30b8951e81ded8aa4d6aed988cad066ea26e5df4f3c05d96a127f69001c0c8
-
Filesize
1KB
MD5fdfa9debca84b88984051e24c9d3ac71
SHA1594ba21b78a309595a323527031a486110270deb
SHA256b2d976c06dbb00d7a5fde6c474fe46add7f5c8e08f0a7e92f08a3252fdd5b164
SHA51209edb221126b68662115085a674243a1c80aa0b79a9404cc6d962aa610135ee069d128cdca9a23e9c6e6eee42816812ead94ae786f4be059f2532974c56f74b4
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB