Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 17:38
General
-
Target
JaffaCakes118_6e519c71c9004226c81445271a764889.exe
-
Size
28KB
-
MD5
6e519c71c9004226c81445271a764889
-
SHA1
f699f321397f5beb9400961176f1f28397e1c6f9
-
SHA256
42d17f4b21a281e76646bef87ef36b17e2dbccbc21183d27096c68e10a9a7c65
-
SHA512
b1bd4f3ebe0b20f668dc5b5b0e1cabbd33ae021d19ae28c75d5daa49c9462ee48a420d1c2247fa81c6e05bb7f038667599f09c0565c379f286025a712c1f9503
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNPIc8:Dv8IRRdsxq1DjJcqf48
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e519c71c9004226c81445271a764889.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e519c71c9004226c81445271a764889.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5d156f5f7b464c50f3da0fbd50bbbf568
SHA11659f9e4ac3b77b01a476257e4f534b148054d13
SHA256a8f2226641672c3a7ac02a3586f3bee4928f8f455eba362977eaf64570d46322
SHA5125a4a18bec9160a43d57e698d78dbf99545c14d16e9c4fd298abadeb2500619d461b93acec46c13e576c001c6a3c2da84f1f0c00cee071b433a2f25fe7f6e41c3
-
Filesize
1KB
MD5ee77a29428e337d719a9e531c1a35a45
SHA1a3bf0245b060fc1abb5fb7500ad3c77daf07e449
SHA2566d9650849d1d0c0680500a9852ba6eec8a85302446366e99a21ca42e965eb68f
SHA5122aabc2ccf8f4fca566313fe8bde3839c172410dfd9036057075dc3ee6299995f74caf6ba4aa406859c918ccb40f3aab0e869438bc754ea4ee072509d5c16b794
-
Filesize
1KB
MD5d72d143b82f8e2fe0556ed1058a8f04e
SHA14771235aac48170fb361113d65b5182bbf7b20c6
SHA2564c89887fa9b21f0b7a1ec1b2975c4ce0795050e2a44b3546f1d2d3b22753d27b
SHA512843df413e7796fd08e35bc90d0341dd15cea302caa496c134970cad8f314435a19a14a0ede25f72c0a156565a2f2c1aefba6a3f0df40295993b9b0edd3c9f891
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB