Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
27/03/2025, 03:41
General
-
Target
JaffaCakes118_897ac92a35debe1d139eb92c73a5bdd4.exe
-
Size
28KB
-
MD5
897ac92a35debe1d139eb92c73a5bdd4
-
SHA1
8ea6be81cd3fb762cfb84c4688f30acbcc0b81c3
-
SHA256
e0ba9390d019eae1312305e760c47b9dec539bd1840270c5c9fa7d7ff2f046f9
-
SHA512
df9fd07ab4f47dfe7fa5a04de8ee0cfac145723968889ad59e96fa40982c9ec880147de3d6aea6317c2546a0c2e981e330a3c14bc1dec8a15f4f72d037a156c3
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN2MgG:Dv8IRRdsxq1DjJcqfRMT
Malware Config
Signatures
-
Detects MyDoom family 10 IoCs
-
MyDoom
MyDoom is a Worm that is written in C++.
-
Mydoom family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_897ac92a35debe1d139eb92c73a5bdd4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_897ac92a35debe1d139eb92c73a5bdd4.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310B
MD5027a68ccbb293e12db6f738027a9472d
SHA158d7b2fee23db86942193ce60b73352986da64a0
SHA2560efb0688a1784eea0d9b432ea2dcf1df8b460e0fc567f4db1114ef35eeffb103
SHA512a78e670c46414b41082cea7ed24ffa82e9717830744ccd50d7aa2df4fbf190ef4c25aea11dd538a913685e9132e93c742f748d050c6830f1451ed0c1754a2ca9
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
153KB
MD5688df0d78b339d3ae7ff29f08a32bb66
SHA16eb6cd00328a0c19bdad92e7e7790263bea238dd
SHA2565d7c7235101ceae69887d3b1deee6a40c1d747d1dc3ecf8b8f7dc28464b9394f
SHA512456537d0bbc7aabd9347734aa472b2ad5877ca79dd8465cae0d3aad6987d2a689b76c614148a8a0c89161ae3ea921d99daa1a5f3e155aabb28184bb239f411c0
-
Filesize
28KB
MD5c5c1d2815dd1c4c6d44284539d144f4a
SHA1a813ae6eec4795fda2004130780a64f24de3b35e
SHA256c33fb1e94f1a5f1497e456285f45e0d97b251ebed8daa8775bd5215e0c19d532
SHA512bd30b28f7e4a821ba3e35347604bb9397489a4585f10880d5e5b816330b4c266b03357b677e96f69f59285d569a4a5ee82601ef4c50bb928f9af47950e0950ae
-
Filesize
1KB
MD53d9445d780f6005b16cec99fb7c4ce32
SHA1f165d369d2c32f2b50f5bfdad70f43396aa1d61b
SHA25674035d0991e4b23eba3c1acbe94fbc83432641f05e5c91029f2b3f9a3ef58951
SHA512e833b84bc9c892fa56c71282e1a9832720b57ea2335102d9ed45961c5296f0cf09ea4716ce4583307c5683471d41d82c1ba9d1780f390601a2b46f5042b300b0
-
Filesize
1KB
MD5655bab7d66fa23e6dc1ab9f2e9de4c68
SHA1b0a852584bd671bb94f14b559948032ce00b2632
SHA256b18de0092867fb8c4d671b8e5e250901d5b64a9fac2f781d434ab09442d9763a
SHA512c1408d69ff90ac7422f9ad6289fac277031be120257835a4a8be639e589e97636263a53b9316b4d3c9d36db6468e591c390601c93fe804086e9b085f08ace22d
-
Filesize
1KB
MD5e6737a7b8ae02a8c540fd99f19b886b1
SHA17d67f1a09add09199f820b806716bc8cf7b432f0
SHA256f437e74edc7041f9d27f512c43c1dd88f69d5043a550abd951d3279747864b1c
SHA512bc6485c75911a7d3cd3ed41a2b9344193ebc8ee1ad689c2bb92d18b69a2824f01ce4296f3cb02d72b8889728126fd5cce7468185865b47c556095954794176f4
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB