Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 10:52
General
-
Target
JaffaCakes118_040b6c9a188e279bd53c84de33fb9570.exe
-
Size
28KB
-
MD5
040b6c9a188e279bd53c84de33fb9570
-
SHA1
79725513817c0504a087e2adee284fc8eb9b19c9
-
SHA256
7f9e894cf5830daa4e806eb76675c3990e2d6d1da6e9151bd723d3c2832230df
-
SHA512
8460b891afe8fd510f8a44a0736a7b8c4131b49e609daa3d6ed41a3d5c73bb06825633214106be130295205bcaebc2717a4aa77fb6c09a9670ee94f87d01477d
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNFRLLn:Dv8IRRdsxq1DjJcqfURvn
Malware Config
Signatures
-
Detects MyDoom family 5 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_040b6c9a188e279bd53c84de33fb9570.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_040b6c9a188e279bd53c84de33fb9570.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD524bf638863a1b4c81af13383a8f8a66b
SHA1531ac5a85828ab1a3351ff29a3765c0c9d2175ca
SHA2567dc7d2331f43b335ea80ff6fb6ce0c047d5225e2aac5e949492a353febb45154
SHA512b87f7e475ee1f0b243f4f332d3cd9341aa50ce8c3fe4f3f229a5673f678bfc73c5c994fd7ca22ac48813feb58cae124f93ea9ac27b287f959bc4445924f3727e
-
Filesize
1KB
MD536e65b3da6a93a3c99ae4a4eada74f6c
SHA10483c46f03c018759b5e277a31903defaafdaf11
SHA2564449c441ae93c714ad34cf76cde41eed58d46b33078f00aaa2d5bcba5ce785ba
SHA512b52d154281d3138a167017f8ae22ea7704d37fdc656e460c474955dc22412b064a1d81a9f874b9d102f93da47f40f9b595be5aaab8fd5e8a2df23f4e566b3b01
-
Filesize
1KB
MD59eace51c18352d5b4ecef4477ef39492
SHA13f79e21cbda372fbc53762d4e747643b8ead7a6e
SHA25645c0fd289a3d762d312ef2d8ba4ec37c7db23a8bdf53a51bb4cffde8194f3c57
SHA512ce2a8e2815bbfa7fa68bd87286f0dcae6fd19331b36a10b96aa87a417b4f6a29f3af9f6a81cb43ab2f20559ed938b92aa1599b6dd082fa541da7b472cf54ef50
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB