Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
04-01-2025 06:59
General
-
Target
JaffaCakes118_784f6e1424617e8238c85a945eda38ba.exe
-
Size
28KB
-
MD5
784f6e1424617e8238c85a945eda38ba
-
SHA1
983ec7bc11e4469c3d90aca150580f20c3dffae7
-
SHA256
72b8245eb0daace450d0f7ee47a243e8cc823ea1cb96e88b65e97e452c20fb44
-
SHA512
097fb1e1ae37667b462222d014cd0403ccedd95aac5ced87ad51fdd12f6b88856f76aa324161883615f8a36776dfb96f257c0521b5bfb6e6d67bf7c4eac2f539
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN6oK:Dv8IRRdsxq1DjJcqflL
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_784f6e1424617e8238c85a945eda38ba.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_784f6e1424617e8238c85a945eda38ba.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5091a00c7882a33a683b0e509eed11851
SHA1a5d9ed599bbfcb49bfdbf2fc6f2cdbc8b325be41
SHA256cb6c44724546b4ce3e9f652dc365e7a8dbf06bd09367927697a501ed9819281b
SHA5125c0d34031f2269e1d720af4f5486059bc067cffe6421ac207d774c36ffae4454c9948ab2f1b97282b43d0dc6d9212c9ea9a894c77ec773307cbdee0d97ce153b
-
Filesize
1KB
MD54e21e0f906ec3ba8c5ab8f4bd2353402
SHA132a156089b1ed17981614651edaeaaeff25077ad
SHA25601ebd6ba464608aee45f39dc219fbd022a75737c4d2976b20b9a66bbe1b4aa60
SHA512598b2cdd12143860d2b96bb9dd7bc8a70e218f535914a0d0f66aad56e955a2d43a9c11c238f584faa0971584c449d20fb97342ce0316dae683e9b7777e7555a4
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB