Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2025, 00:17
Behavioral task
behavioral1
Sample
JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe
Resource
win10v2004-20250410-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe
-
Size
31KB
-
MD5
b0732eb2bbfeb88bf8d7439c179b331c
-
SHA1
bfe2b09ca109175977425966c98fc05a6da62615
-
SHA256
4f24e2b2d5da2b6bf2e36105cee68f2b4d7c31c0266784eb95aacf7f5a8f9d59
-
SHA512
c3e9ece3b7f5834a890760a96a6418d411cd8131481a107c9d108afadd64ac7fad78b924f5e6e570c0897c4787248d02536288fde5950d4b9cb1777d2b4cd324
-
SSDEEP
768:SCIqdH/k1ZVcT194jp42eOLLC4CvivAdPwxUXZ:SNqaLV8a623LLCJvAKyUp
Score
10/10
Malware Config
Signatures
-
Detects MyDoom family 21 IoCs
resource yara_rule behavioral1/memory/1284-9-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-86-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-87-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-139-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-164-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-165-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-247-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-326-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-327-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-330-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-331-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-335-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-336-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-426-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-427-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-468-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-515-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-516-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-598-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/5072-625-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral1/memory/3972-626-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom -
Mydoom family
-
Executes dropped EXE 2 IoCs
pid Process 3972 lsass.exe 1284 lsass.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe -
resource yara_rule behavioral1/memory/5072-0-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/files/0x00050000000232ed-4.dat upx behavioral1/memory/1284-9-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-86-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-87-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-139-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-164-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-165-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-247-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-326-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-327-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-330-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-331-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-335-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-336-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-426-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-427-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-468-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-515-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-516-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-598-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/5072-625-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral1/memory/3972-626-0x0000000000800000-0x000000000080D000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\Harry Potter.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Kazaa Lite.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\Kazaa Lite.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ICQ 4 Lite.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\Winamp 5.0 (en).ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Harry Potter.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Harry Potter.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\WinRAR.v.3.2.and.key.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5D783746-AD42-40DF-8175-7B6E219402A9\root\vfs\Windows\assembly\GAC_MSIL\Harry Potter.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\Winamp 5.0 (en) Crack.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Harry Potter.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\Kazaa Lite.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\Kazaa Lite.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\WinRAR.v.3.2.and.key.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\Harry Potter.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\VC\index.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\ICQ 4 Lite.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5D783746-AD42-40DF-8175-7B6E219402A9\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Winamp 5.0 (en).com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Winamp 5.0 (en) Crack.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\Harry Potter.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ICQ 4 Lite.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ICQ 4 Lite.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\Harry Potter.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\index.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Winamp 5.0 (en) Crack.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\Harry Potter.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\ICQ 4 Lite.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\Kazaa Lite.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\WinRAR.v.3.2.and.key.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\index.ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\VGX\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\WinRAR.v.3.2.and.key.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Harry Potter.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\5D783746-AD42-40DF-8175-7B6E219402A9\root\vfs\Windows\assembly\Winamp 5.0 (en).ShareReactor.com JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\Winamp 5.0 (en) Crack.exe lsass.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File created C:\Windows\lsass.exe JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6092 wrote to memory of 3972 6092 cmd.exe 86 PID 6092 wrote to memory of 3972 6092 cmd.exe 86 PID 6092 wrote to memory of 3972 6092 cmd.exe 86 PID 1852 wrote to memory of 1284 1852 cmd.exe 89 PID 1852 wrote to memory of 1284 1852 cmd.exe 89 PID 1852 wrote to memory of 1284 1852 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0732eb2bbfeb88bf8d7439c179b331c.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5072
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3972
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\lsass.exeC:\Windows\lsass.exe2⤵
- Executes dropped EXE
PID:1284
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5e074083cf2ad21327f6c1a7acadb6312
SHA13b4ca64023e73cbc75114dff05909cdd81affd84
SHA256ee94a27ab0672019200be0244287dd3edb72f2b0949242ad9f58fa1a663c01d0
SHA512086125b25961e530de2b0d2e38f2e70f6bf759421758c2608b279aa9f3a62e241a83c2f9f513ec8adeef775eabe3d2888aa54224650c2594a82447c551b3c80c
-
Filesize
31KB
MD5b0732eb2bbfeb88bf8d7439c179b331c
SHA1bfe2b09ca109175977425966c98fc05a6da62615
SHA2564f24e2b2d5da2b6bf2e36105cee68f2b4d7c31c0266784eb95aacf7f5a8f9d59
SHA512c3e9ece3b7f5834a890760a96a6418d411cd8131481a107c9d108afadd64ac7fad78b924f5e6e570c0897c4787248d02536288fde5950d4b9cb1777d2b4cd324