Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
23/03/2025, 16:41
General
-
Target
JaffaCakes118_878f7d309f92a86c7431459a954ea769.exe
-
Size
28KB
-
MD5
878f7d309f92a86c7431459a954ea769
-
SHA1
a6af35e95b7df7f2d316c1cc61e3ea23e6ebf5b1
-
SHA256
c85a553e588d2a7f3d277051a1d04b4c85293376c4f28cadfc77526e5dae7f27
-
SHA512
2935f7270cfe81e60bf5d9d00313316d2689df6ed683a66bad2024a825be3ea29d6aadff25eecf084436bb57f0cc6a0ba401426889c394325e76a6fc9e2e7b5a
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNx4V+mLd2cx:Dv8IRRdsxq1DjJcqfkaHLf
Malware Config
Signatures
-
Detects MyDoom family 11 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_878f7d309f92a86c7431459a954ea769.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_878f7d309f92a86c7431459a954ea769.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153KB
MD5063c7aa3c1cfc7b18eb433bfba216438
SHA15b5cab08b3fecc1a4f5a402f4bf21da2be2fb2fd
SHA256a207233aac71e6ab1b35e0ec378e5cbed5af305e3717259827f85bed736fba5c
SHA5128d9b049623fb06781b2467258531ba2d49810ebee791f1d4e31a8760d8715271ae8c61a926fee100ad5303be07027483ece81aad9e603dfa49fe1c01641e4c78
-
Filesize
1KB
MD57278e4ff28ec60fea50a08ab6a8736ea
SHA1fa2f4fe5d79a8fe1395457c5dda20977c90a9195
SHA256ebb0f059505efe92997be0ccba6bc8dc52c513ab40165b7b1f8d186f1eaa6c44
SHA512dcedfae46385c12977bd6bedd83fe17bd03be79b23c74b3bfa6e93bcbc364657901246d5e85e6e4060bc3caaf61f4ecfd25255150553be086f81bea2d29d1465
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
313B
MD5ffb72ab4faba49ad441ce07db37dd8b6
SHA1194e13c1c32ebb6e7a1dc912261cbd58a82ff71e
SHA2567bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
SHA512517be20d2442489ce39b48dc7f9f6f13f8c45d02703fb1865071f553d36b2289f5abc26c6089fc0bfad1a41fe318bf4b5a806915c5e45898ac744b7e4ed30257
-
Filesize
117KB
MD5b3cd4af1214e843752922a9eb731288b
SHA1d07ed8f77d10d4ca9c93134a2d5722af241cadb4
SHA256ebb744cbf0332ac790d11823c0bf9e1ce2af66bdf247a94fc1bd04b16407f1e8
SHA512a26c541cdac57c94627825de0fc266c26e0d4947ea1a29e925d742036a241b45c7f36d88a53787ecf508e3cce23d8c1dd0338f859eac1a4bb107177a957d5962
-
Filesize
28KB
MD500afd929226712e1c57230a88dbc7346
SHA1848d9a29d63c245f505b1e9fb08db8ab7782d561
SHA25625ee12d3eb8aea53d5df74832d4079eb0708c39fb670c16b20e71cb8a214355b
SHA5127f9c5a80fd0aa8238a7aa8babad777132f3d7d4dce60e9904e185e365b6b0dd9fa80c69a22178df2747f3279f3044d9214d89c1c544e4beec2bc46ce43fe5766
-
Filesize
1KB
MD57b425548a944546af0940c0884cb45b7
SHA1b83132fa7b07dd8c24d37068a7aacb36e41a6130
SHA2563db05121471c452fac4a53bffcfbf88d69746d3d813bffce57213342047d1c67
SHA51296b6b65a55e197da2b3b97fbbec89764f1018e6519787f9081204c12e9eca46d97ba112f0fc549c03a5e19a3c58fe4e6d5878ddd1aea4fd3468745417a80cfa0
-
Filesize
1KB
MD588ec9313dc914e69f5c78661d7ff372a
SHA112ef4d721bd06bf4fe803012aba6f7e1b269b8b9
SHA256c676a3080be88fb25416bb6e684f5a78a3e8602d56e6a94775a0458fd0389d55
SHA5129f08b6b5026aebbc753b0218b15bd56c4b46424f1e8859ccaea37774b3307095200e20e424e1fb7e991a9a4f12e5f93f37ca2f08b7d643c4ca53428c09f6ee87
-
Filesize
1KB
MD54d92d25830cca713e5fa6d6729410c35
SHA102c46cbea7bf073ef693f73a95982585d2e72670
SHA25661e675678de5e54c54689439a529bf8b89a7143bc70d489de6514825dcb07b3b
SHA51222597c0d77bd87bae3f83cffc2ed9710e4a48d9a9874f29e4ebc77eaf66c97d18ae289bf238078613ebf27c34847293e56bb3965b04c97df376c53b8db71f5fc
-
Filesize
1KB
MD5cdaf5a759dc8aa05da3faaaf987ef015
SHA14b21935b333f26a66dc8f81146d97123ae4af2e9
SHA2567ce776dcf945879f1f54474b523da14962d8060b6e4ad63606fa99d7675ef3c3
SHA51232b5bcb4cec498382252bfacfaab86ab4cfbfa1413db8290cd4dafe5cd11b4e6d457fa1c7444e31064dd2956832748655f9473f23187e4c84d08c93b142c8165
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB