Analysis
-
max time kernel
22s -
max time network
23s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 09:17
Behavioral task
behavioral1
Sample
JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe
-
Size
28KB
-
MD5
8a8676ba6835a04127ea0d79dbd5747f
-
SHA1
7956a0700085fb19fd912565fa45f676e86d6dd8
-
SHA256
25170b69688ea4173e7b6885fc2a4f19788b079dd7633003f9567f9d8210caac
-
SHA512
856aa358707855d97f0eca6e93827f518f9e6a39b145df8204067592a04c16cf30cbc99d659cdcf607403f2378dcaad63674092aead3b4ab602cf16197dd4997
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNiU9uy:Dv8IRRdsxq1DjJcqfxU9uy
Malware Config
Signatures
-
Detects MyDoom family 3 IoCs
resource yara_rule behavioral1/memory/1964-2-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1964-17-0x0000000000500000-0x0000000000510000-memory.dmp family_mydoom behavioral1/memory/1964-18-0x00000000001B0000-0x00000000001B8000-memory.dmp family_mydoom -
Mydoom family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 2092 services.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
resource yara_rule behavioral1/memory/1964-4-0x00000000001B0000-0x00000000001B8000-memory.dmp upx behavioral1/memory/1964-2-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x0008000000015f6a-7.dat upx behavioral1/memory/2092-11-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/1964-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/1964-18-0x00000000001B0000-0x00000000001B8000-memory.dmp upx behavioral1/memory/2092-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2092-20-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral1/memory/2092-28-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\services.exe JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe File opened for modification C:\Windows\java.exe JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe File created C:\Windows\java.exe JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language services.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2072 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe Token: SeShutdownPrivilege 2908 explorer.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2072 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe 2908 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2092 1964 JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe 30 PID 1964 wrote to memory of 2092 1964 JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe 30 PID 1964 wrote to memory of 2092 1964 JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe 30 PID 1964 wrote to memory of 2092 1964 JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe 30 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a8676ba6835a04127ea0d79dbd5747f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2072
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2908
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510427b3a3876ca01eafa843901a8d3a6
SHA169c1747deedcab08e7bfeb72a4b799e130291a5f
SHA256f43b4efeb6ecb01cbda8947a00191b4a8e1b4e7bd1c4b81205975fd58aecc94e
SHA51291e78c0b249f598009f56e6c2bd8f32b290cef93d498fde0435ec0d66757ab29c3366400cf006d841b06f29560be64c9c8db0349982520aee258185c1ee9ee7a
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2