Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 17:36
General
-
Target
JaffaCakes118_7af3589e72ccf769b8108abe5ae5ac54.exe
-
Size
28KB
-
MD5
7af3589e72ccf769b8108abe5ae5ac54
-
SHA1
2a306eb11962e7a844838f9a5aa612cf4601a56d
-
SHA256
905d6593c8e128c1e0819185f910175b16e74d20047d98e2e1e673ad240cb31b
-
SHA512
5ae857b4753b950495e9c715df63b66d396942b47feaed6ffa96b965679bbb91774eda59e6db728c50b1834450bf5a173a1a260ea72af9f58a01c2c3a636b9a7
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN+cu9:Dv8IRRdsxq1DjJcqf1cu9
Malware Config
Signatures
-
Detects MyDoom family 8 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7af3589e72ccf769b8108abe5ae5ac54.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7af3589e72ccf769b8108abe5ae5ac54.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD521d0991a9fb97e390886bab938c28fb5
SHA17cbb2e96458ba353404157d113775ae58c1f0a04
SHA25643eabc034d738573bf2f9e97032dd7b92e0954d657e6884b33acbfa4aeaff6d7
SHA51273a61930e0e0bdc3e004840b8b4b77120fb81f31c6571a7cbe83984d2f2e485736774ccc290327a5764fc5675852e4ca5ff2a41fd647194a92137f6c30c8dcd8
-
Filesize
1KB
MD5f73941fbf10c892f83c6b37d26661a42
SHA12a52edaa04cadda26aa662f6ec1e113f5af3a029
SHA256b309f485a2949b0f47a79e1ed23508c36fce193b6c302704c519c2a62ba3d159
SHA5129542124ebfdd375da580fdf6607b68fc5c63a6bc913556e75535b0b8967b21bd376f1fa6904af42efa56f945a1bb97214b2107acd97636032857d10363c16ed0
-
Filesize
1KB
MD5124a6d0f92e40de6474582e18f541d8f
SHA1148f9c8c7b9f6f80158c6acc9a9657cdeb4a0e8b
SHA256c54b605f24fddf4da2080ba9f0f72a9b2ea80f9e0dee335ff089b12528dfc548
SHA5128983e1cdb9f6b314081e25202b8cc0afe37500cdb242f246e9dde1cf2c8f6035eb76033dfe929592a0b79f6b18304e9965056e3da761ccd6c7e30b3a32cab14a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB