Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 17:25
General
-
Target
JaffaCakes118_7ae68eb1419014906b53076f7aa02b6f.exe
-
Size
28KB
-
MD5
7ae68eb1419014906b53076f7aa02b6f
-
SHA1
9d558bec8ed52e27873b4b8fc4823fce7d2a6958
-
SHA256
b125f7455e2571b43e5e2e6c1aa9a860477d9c6157b32b5f7d49a57d5d55522c
-
SHA512
5315230dd2d1363f7bf4204f093f50bbfc7121ea8692fead1c8ab54d611bd124908003455da2dd6c83cbb0386c10e6a0fbe2c985434759400361bf5c87d93660
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNa:Dv8IRRdsxq1DjJcqfR
Malware Config
Signatures
-
Detects MyDoom family 6 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ae68eb1419014906b53076f7aa02b6f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ae68eb1419014906b53076f7aa02b6f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD5490b48372cb3e2a33767be6ff60768d2
SHA1436d89a405e4e4193541ab2bd60529c53aaa8661
SHA256db1fc39a96fcf541d705415ece6bccd4a33f969f6f9f41eec53f0037c85300d3
SHA512e9b57062773e5e7971366f47d5bdc2f4c858dedf72b3eef64a55ceb74f7424507ca74b19d3ea6b15517be1432670b0473b40b8a139f6c7412e4267dfd76d3972
-
Filesize
1KB
MD569a06cadfb0dd3f1e44fb20e5124f4bb
SHA12e446ce2eae10b28819ccb6552942f1b1f4596e2
SHA256e8d7a4c947bcde0c4ed084d9e01ef6fa2cc2b00b51fef0bfaf6d5d630f78f1c6
SHA512dfe23ce37801b592d50f88b473955a3b10c54c8c027d5e956c332f149b85161009737be1609d45da82d0f55a176c5329584196cd232812d3729887d22f2d72e0
-
Filesize
1KB
MD5fc48c8300647798f1ea1e939d23ac87e
SHA151194bed482072f6cd67092d0a174f6a9694cc55
SHA256443350c0ee613b8a4cf50791ec732587ad6e6a89689a922c634e4b79377fe687
SHA51212345e5e82d8ff7eb7feb3e8044f276bc11d790bb8f238cd2baec43c32f5d01683b6aedc26d8dab401fdd718bafc241ebc3b3ea54b05d8aa5cff56bbb80d63fa
-
Filesize
1KB
MD5385192019a6591f4702e308adb4bae07
SHA1edb7940bff62c2708e62c7edf90fca83aa6b68fa
SHA256c0a2ab6a6b048de2a4b6b03e5d781865fb552822d31c9fd9ef450b9a7d1d869a
SHA512dd03093f2baa91ebbeca1d6a1a15b77a2707e5673333297c29a822a09e396a793a90afe40d782441fcd8b5a5b1f926cb2588658ee76ea147fe7e01485d264bd6
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB