Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
26/03/2025, 07:51
General
-
Target
JaffaCakes118_88f7049b727da176c21c7f63dbf6dca2.exe
-
Size
28KB
-
MD5
88f7049b727da176c21c7f63dbf6dca2
-
SHA1
9244d897bfffe5db424fcd3665a2789b9ace285f
-
SHA256
0f5a3d265bb5364e1d0439baf2bd70527a813ba21ff7ef680c362c22a11995f8
-
SHA512
3f41d247d6b6dbce8f50663474a25c5e231076e3d8a3f1f4e41f30d73df1b53e1966b08eb94e26b70782caf43e56f55a5481b17dafaa471452b216cb89273343
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNyRuXZ:Dv8IRRdsxq1DjJcqf3uJ
Malware Config
Signatures
-
Detects MyDoom family 9 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88f7049b727da176c21c7f63dbf6dca2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_88f7049b727da176c21c7f63dbf6dca2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
312B
MD5c15952329e9cd008b41f979b6c76b9a2
SHA153c58cc742b5a0273df8d01ba2779a979c1ff967
SHA2565d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
SHA5126aecdd949abcd2cb54e2fe3e1171ee47c247aa3980a0847b9934f506ef9b2d3180831adf6554c68b0621f9f9f3cd88767ef9487bc6e51cecd6a8857099a7b296
-
Filesize
153KB
MD59e4e39301c7dff7c090cfc1a9a5198a9
SHA149da47795149939cbe4daede35b848c6c6d9a0b2
SHA25644f6253efb7c20bfcf4cf886addda94ba77a649550a9ec35c196eac855a804fa
SHA5127f8234f7123ab53b2b818c18098650fc517aa3604e56fa721a605b0dfe81cc69c688c019ab0bfac839f6016771186adf797b9b543279bffc2f30d7a36762f09c
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
28KB
MD55d6e2e5a0cec47f02f2867e58fac3318
SHA188c9e18cf65595cf15c8c6a9fd67c29e847e78b3
SHA2568d1ff58330504a319ff742bf17a257e96b21385c2ed1c90c98ac43fcea95b952
SHA51262ea0b41d625e332de637f58ac1de7de953071688ff788c3960bd8ec68bddd84bc00f8924da1080eb8140106bea127100035727ead5556fca800369ae26bcd71
-
Filesize
1KB
MD575ae317eb6fbc43e4c74b146e9951295
SHA1c3da80fbb1d9c9f0dc0741573f32b139f6ff60bf
SHA256ff2d631ea1c5178d398d6437ed3a5848b1af8040a23f3512874f7854af243738
SHA512084ee61f9264faa4ad3cb44ac58540e89c214be393ddb839e428c7e8b26208a2de27d571cc3de4e34662cb5ca5ea39594f21640ab08b661f1e46f6dbf0239473
-
Filesize
1KB
MD59e3c38df371f9e8b6d57b70aa13668a8
SHA1e0c3e024bd9e327fa970a45abaa45563df945d82
SHA2568e497279c130800da8fc77f93153c27e9047c7229e1e44f51ff69cbc74119992
SHA512681ff019a6913f1c84c133f347d3dcbe2ebd5c7b47f91d246a62e22a1eef230fcb91249e88ce0a48f8bb8c529cccee1891602e827279d3285ce5d70c3f75e3a6
-
Filesize
1KB
MD515fc44c39d1ec1b641518d84b058a1cc
SHA1c628f22745e34f09a34c5dd97b69ea0816a2ee3e
SHA256a32042e98ea2335c8dfe6a3547df67e0386bbe164d511687fabf116592df08e4
SHA5122f591b9c30740307a8cb4a544914a0ba7e09605672d2735022d26956ddfcc0acf5fcbe8a002d6f7a21713cb892d17f87b87b2c90bc1c9f6df9e633e8f0c5a366
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB