Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 13:18
General
-
Target
JaffaCakes118_79e430bb62ed2e49e3604209e16ac1fe.exe
-
Size
28KB
-
MD5
79e430bb62ed2e49e3604209e16ac1fe
-
SHA1
c122a9753f41eb576b312ba068848dd1b5fcf859
-
SHA256
36ecc8c5984ef0b1ac74217cdd7688f86f8f879ce969d857dc403c2d5f7021e8
-
SHA512
e1138c21d569a1ffc68ab65930d5fb29f102c05879a9a65744bf723699cdcc2b1e4596193c062aa5f917953ab3e88568da39fc00efc6940100e3d1f82a55ebe6
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNuHi:Dv8IRRdsxq1DjJcqfBi
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e430bb62ed2e49e3604209e16ac1fe.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79e430bb62ed2e49e3604209e16ac1fe.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5b5d66f0c60d5051a56c8ed1458d2088a
SHA1440138075aa35e49d74d831a1ed97ed2ba629bc8
SHA25663249888e80de1ad1fca4ad666cbe48f1806d116340ab71eeb5b4add96a62f26
SHA512b8e6025f6b7e72af4974e46cf537a21c7913e90287126fa5ae5d32a6b01f6e7e39f7f0ead7f8a61a398a4de144e54f0d6674b03d7d1b900fa7cb18bdaf0d22c3
-
Filesize
1KB
MD58d03dc9ac7446ecf16b8d00c2f8eb747
SHA1b4d444cf2c4e48b66540b2bad1209163bbc33056
SHA256ce287f382e570b15184374a0f0f5a7968d28b902bdced1ba549aab1b1a6d293d
SHA512a2ffc4caf215f71ce893edd351aebb5565ac0ecb8387b4304b7e97ead74fa2198447e1bcc089903ff7a7b570f856520571630f9defe3c65230dfea8407ae5bd3
-
Filesize
1KB
MD5b183dbba4b8766693096a474a5c2edff
SHA1f6c6758c45b2233d03650d47f13af32798bd4949
SHA256948b3ea1ea2415ac1d75f110eb37c3426c53addad308f1222394ad2f1eb1f7bc
SHA512458edcc9d5b15fbab7b6bd835d85ca3d07e68ca6c69b354c7fafc1ac744db6a748aa880fd807c66824d93d0e4add9bb33c01e3a72df62bd85d2cf7715f00b600
-
Filesize
1KB
MD5d53833e612031839102e0f234353c4a0
SHA1651445ccaae9b28625abcbe60814d230c8035d2c
SHA256a251109474c35150d1c7f27fb0070daffa666967d5bbac1e5f15c5c3164a47eb
SHA512d6a0b3f825eff7a898b232ee7c892b9ae0c3a540e2afb8f1f5dde2d22300fb374dd897f878e0bd49084730ba0639c8296d506cca70960fc6c9744d21d8df2da3
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB