Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2025, 21:30
Behavioral task
behavioral1
Sample
JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe
-
Size
48KB
-
MD5
aba8b95f7dd7edb17efb2af762e4609a
-
SHA1
799f3cbdc73a87aaf277e907a902ed58481912e5
-
SHA256
efc2fd407d36be9f51434107eb134b77dcbb678f749c612843d560276b0e153c
-
SHA512
67a46e6d3ac353766b30daca4cfb9c862e6990f88216196c3c29a6c394cee87b20f1890c0a15f3588d39fa8676c34016614e48321b92518f0f7815dc53d19230
-
SSDEEP
1536:SNqaLV8a6Tx54qTKGJ8w2h4WPsVR0ciQZMCoQ:SNqMGaqTmw2hRPsvXVB
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 21 IoCs
resource yara_rule behavioral1/memory/3576-9-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-86-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-87-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-147-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-166-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-167-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-256-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-304-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-305-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-308-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-309-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-313-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-314-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-365-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-366-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-434-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-441-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-442-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-497-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/2436-582-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4376-583-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 2 IoCs
pid Process 4376 lsass.exe 3576 lsass.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe -
resource yara_rule behavioral1/memory/2436-0-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/files/0x0025000000022f12-4.dat upx behavioral1/memory/3576-9-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-86-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-87-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-147-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-166-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-167-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-256-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-304-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-305-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-308-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-309-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-313-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-314-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-365-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-366-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-434-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-441-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-442-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-497-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/2436-582-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4376-583-0x0000000000800000-0x000000000080D000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\Kazaa Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ICQ 4 Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\Winamp 5.0 (en) Crack.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Winamp 5.0 (en).exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\WinRAR.v.3.2.and.key.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\Winamp 5.0 (en).exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\279A9937-B4FC-4577-887A-4E7154A03AFE\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\Winamp 5.0 (en).com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\Winamp 5.0 (en).ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\Winamp 5.0 (en).com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\Kazaa Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\ICQ 4 Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Winamp 5.0 (en) Crack.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Winamp 5.0 (en) Crack.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Winamp 5.0 (en) Crack.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Kazaa Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\Kazaa Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\WinRAR.v.3.2.and.key.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\Kazaa Lite.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\Winamp 5.0 (en).ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\Winamp 5.0 (en).com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Harry Potter.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\279A9937-B4FC-4577-887A-4E7154A03AFE\root\vfs\Windows\assembly\ICQ 4 Lite.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\Kazaa Lite.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Winamp 5.0 (en) Crack.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\ICQ 4 Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ICQ 4 Lite.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\index.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ICQ 4 Lite.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\Winamp 5.0 (en) Crack.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\ICQ 4 Lite.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\Winamp 5.0 (en).com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\index.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\Harry Potter.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Winamp 5.0 (en) Crack.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\ICQ 4 Lite.ShareReactor.com JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\lsass.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe File created C:\Windows\lsass.exe JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5736 wrote to memory of 4376 5736 cmd.exe 86 PID 5736 wrote to memory of 4376 5736 cmd.exe 86 PID 5736 wrote to memory of 4376 5736 cmd.exe 86 PID 5556 wrote to memory of 3576 5556 cmd.exe 89 PID 5556 wrote to memory of 3576 5556 cmd.exe 89 PID 5556 wrote to memory of 3576 5556 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_aba8b95f7dd7edb17efb2af762e4609a.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2436
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4376
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
PID:3576
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5bff39d00dc35d068f8a36fb7cdf0786d
SHA13eba3aa0a557738fa8fb0b2ae3853f6fdd9ffe81
SHA25638ea2c56adb7e3aed9341a8e73c409c83be5e70ff0be91c080c3de576b3f27c8
SHA512259e6f9cc7d33cc7ea860603a814bf91b10a8cd52ebf0e93fc2eafdcc6b99be7da4125fa72db7b07d4a44579cdf7263bf0c83961b4020fa31ccfc149172ad5f7
-
Filesize
48KB
MD5aba8b95f7dd7edb17efb2af762e4609a
SHA1799f3cbdc73a87aaf277e907a902ed58481912e5
SHA256efc2fd407d36be9f51434107eb134b77dcbb678f749c612843d560276b0e153c
SHA51267a46e6d3ac353766b30daca4cfb9c862e6990f88216196c3c29a6c394cee87b20f1890c0a15f3588d39fa8676c34016614e48321b92518f0f7815dc53d19230