Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 09:32
General
-
Target
JaffaCakes118_78f0c78732c9e390523a86c69e29a05e.exe
-
Size
28KB
-
MD5
78f0c78732c9e390523a86c69e29a05e
-
SHA1
bc45fbc404021d2f0c8613cda491dca1b89bae2a
-
SHA256
0bbf671900fc70586195a7b96d4017ee9f876c7d1c0253aa51794d7f86ccde27
-
SHA512
e4fd632ac3eb0c3524fd172d78d90f3babb65f4e9a7cc833f94e67b068a5c036eb41047c8a5d888b246902b7761848988a7839fae1ea6650635a74681038b5de
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNLIo2Su:Dv8IRRdsxq1DjJcqfe8Su
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78f0c78732c9e390523a86c69e29a05e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78f0c78732c9e390523a86c69e29a05e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD59d4bbf3a5dea4a47e9fbe9038d9bb5e5
SHA1e5438905221b8e192c34d7e551ed5819221a6066
SHA256e47cc8efa40750b3d60a97c266782c608eb93493444e136662a9943ec69623ee
SHA512af54c46ad68a68a33114b14cc568805ebc25e2a120a0951fc0aaa9f442ec70cb1361bb0f9397a3e9bd41e49a36e9a8add0843445bb61195d5f6de69cdc54add4
-
Filesize
1KB
MD5c020b40329d99055d45b4d564f56deae
SHA159042b5fbd63bf4d72ae44bc417afe4c94d66f92
SHA2567d5bc09147223c52c68336a9e8adc1387e63dcba63aa72f9b466b01d2b5c991a
SHA512a10855e77c7edf2ddb896465047f04764728faec40bce1a9e798c593d1cf86d74f00b78f08df934ebce66e3e1c9622eaba35d2d451214530a8515875bfa33385
-
Filesize
1KB
MD5d83558ec44befce0004974afe193ea4e
SHA127af0e4afbd16d31accffd73fb95f92d4940d54a
SHA256707de7c2d47054df6ad472c260d636777333fe5e6665c07813bd36d27cc1bb40
SHA51248fc096133578ee1fee0ec88fe65659b627cba0b542a089846f2809a1dec690abf412dc3adbf985f0bd93df81c62946ca136c487c2c65cf313c8e9fbf64319ee
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB