Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2025, 23:52
Behavioral task
behavioral1
Sample
JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe
-
Size
46KB
-
MD5
b2f594ae9f0e41c1e58ca1193fc3c2fa
-
SHA1
e10fda9d442812ca102c8cf61e565c9198620209
-
SHA256
675b8439fd1859840ff01659f0bf37cad63ea400fd4b54970dad4413570e6cca
-
SHA512
5991352c5a7210114bb1a1f10de33ab6e3f9920d9e4e260021c4818278d486a64ed0b17eb7d8ea71d39bab205684c8d6588733656425bf9c8512d61e087ed9ea
-
SSDEEP
768:SCIqdH/k1ZVcT194jp4MXjV+pm+IYVyMIUcDUtrXiu/Y4Ln:SNqaLV8a6MwmBYs7UwunLn
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 21 IoCs
resource yara_rule behavioral1/memory/3384-9-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-86-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-87-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-139-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-169-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-170-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-247-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-297-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-298-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-300-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-301-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-306-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-307-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-370-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-372-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-432-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-439-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-440-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-498-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/312-577-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/4088-578-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 2 IoCs
pid Process 4088 lsass.exe 3384 lsass.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe -
resource yara_rule behavioral1/memory/312-0-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/files/0x0012000000023120-4.dat upx behavioral1/memory/3384-9-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-86-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-87-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-139-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-169-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-170-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-247-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-297-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-298-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-300-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-301-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-306-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-307-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-370-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-372-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-432-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-439-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-440-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-498-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/312-577-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/4088-578-0x0000000000800000-0x000000000080D000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Stationery\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Winamp 5.0 (en).com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\WinRAR.v.3.2.and.key.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5D783746-AD42-40DF-8175-7B6E219402A9\root\Harry Potter.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Kazaa Lite.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Winamp 5.0 (en) Crack.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Winamp 5.0 (en) Crack.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ICQ 4 Lite.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\ICQ 4 Lite.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\index.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\ICQ 4 Lite.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\index.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\ICQ 4 Lite.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\Kazaa Lite.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\Updates\Download\Harry Potter.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\Winamp 5.0 (en) Crack.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\Kazaa Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ICQ 4 Lite.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\index.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\index.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Kazaa Lite.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\index.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Winamp 5.0 (en).com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\index.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5D783746-AD42-40DF-8175-7B6E219402A9\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Winamp 5.0 (en) Crack.ShareReactor.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\WinRAR.v.3.2.and.key.com JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\Winamp 5.0 (en) Crack.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\ICQ 4 Lite.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\ICQ 4 Lite.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Harry Potter.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\lsass.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe File created C:\Windows\lsass.exe JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3304 wrote to memory of 4088 3304 cmd.exe 87 PID 3304 wrote to memory of 4088 3304 cmd.exe 87 PID 3304 wrote to memory of 4088 3304 cmd.exe 87 PID 5020 wrote to memory of 3384 5020 cmd.exe 90 PID 5020 wrote to memory of 3384 5020 cmd.exe 90 PID 5020 wrote to memory of 3384 5020 cmd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b2f594ae9f0e41c1e58ca1193fc3c2fa.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:312
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
PID:3384
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5538ce375990c9a42faedcb5cd62b1462
SHA1f7dbb44ed2848a5645a8f22a9218f5ec591626e8
SHA256e829cc5731a7a8512d3ee1ca213d26cb12ae4c646a1760b357f11366a3633edd
SHA5126814f4c035b853ff470eea2dbe42b2a3b6f93995c20bea8711ee390135905d3a5c567554eabc3043cd30ec7303d9af07390ccd0dfc95d868e2a58bb21d54d06a
-
Filesize
46KB
MD5b2f594ae9f0e41c1e58ca1193fc3c2fa
SHA1e10fda9d442812ca102c8cf61e565c9198620209
SHA256675b8439fd1859840ff01659f0bf37cad63ea400fd4b54970dad4413570e6cca
SHA5125991352c5a7210114bb1a1f10de33ab6e3f9920d9e4e260021c4818278d486a64ed0b17eb7d8ea71d39bab205684c8d6588733656425bf9c8512d61e087ed9ea