Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03-01-2025 10:23
General
-
Target
JaffaCakes118_6bf44e75d937da9c1e286383e1e29a11.exe
-
Size
28KB
-
MD5
6bf44e75d937da9c1e286383e1e29a11
-
SHA1
94c97642a1306055663427efce11719d6e59f0cb
-
SHA256
db9f477de20f3d6af6c93c6efbb43d1fa3983460169f995f7df47c6527a3702e
-
SHA512
2b7bfb2acc9984ebc4357b52ed09bc53d7f8c9d1e9fbc7c2ce0d47b50b9b845fe735d20d9cbdf374813cc66a9ea616587ee628cd331d010a940b78498a8ceb22
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNaE8TNzP:Dv8IRRdsxq1DjJcqfppNzP
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bf44e75d937da9c1e286383e1e29a11.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bf44e75d937da9c1e286383e1e29a11.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD544bb22ad24789abd5dfcdbbbc2a150a2
SHA151e1c55d476b9dadb93ad621d824570d7d2adee1
SHA256702e3ec6fe1c99fcd8b716833b6cabe1ffd6be5463290849c21d92319ea625c0
SHA512be8d404321fc077ac336e47c24052cc4eae4697613dc702b2be1ef52aa46ccba7399dd34d9e1c4f9479cad0f8c1960f0353dced1debba7b6d1b533d8ef806b8e
-
Filesize
1KB
MD52bf674b2238c4562281bc8046dcaa067
SHA1271a62f18514919f4d2f3bcbe0d368af38725bb7
SHA2566e8d5908f89ebd5deda6195d5a21a01b65f530f01a73e2e7a8a7524f997442fc
SHA512b07def3537c84ca1829246fdd988f4ab7ea1a5c48b216532e048333b3d2fe3bf1c9c1a164916ef90eadaaa96eb33a6a52bd469bb5b4de89054d8c10a62b7ef7f
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB