Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
- Size 6KB
- Sample260925-2m2nvaycja
- SHA256 54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8
- MD5 45962abd76685d8547238d4f3111e9be
- SHA1 7edb2fa19f390105b4870d7ca79b1b6e5d294db6
- SHA512 409f2067eeb39636e0101b961718db6f572538da133bea872c299e542ed83c0ec07e16e133909d47af2ae138501e4917fce5a59e03c140ecc993342155d74ec8
- SSDEEP 96:H4KnYuRu4Z9j3l0vKv225eItwQe2qwevkEOUyzlFKmdLk:H4KYuRu4ZIQVRwQu9kbUyzll
- TLSH T15BC1B6869DAD9893C43192701601355BBA37B90C06F9CA140F88E52BF8BE8E391FDB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 112 runddl32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsock startup = "runddl32.exe" jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsock startup = "runddl32.exe" runddl32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\kazaa lite\my shared folder\Hotmail Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\ICQ Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\winmx\shared\L0pht 4.0 Windows Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\Norton Anti-Virus 2005 Enterprise Crack.exe runddl32.exe File created C:\program files\kazaa\my shared folder\AOL Instant Messenger (AIM) Hacker.exe runddl32.exe File created C:\program files\kazaa lite\my shared folder\AOL Instant Messenger (AIM) Hacker.exe runddl32.exe File created C:\program files\grokster\my grokster\Counter-Strike KeyGen.exe runddl32.exe File created C:\program files\kazaa\my shared folder\MSN Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\Microsoft Visual Basic KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\NetBIOS Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\winmx\shared\Microsoft Visual Basic KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\edonkey2000\incoming\Microsoft Visual Basic KeyGen.exe runddl32.exe File created C:\program files\limewire\shared\Password Cracker.exe runddl32.exe File created C:\program files\tesla\files\DCOM Exploit.exe runddl32.exe File created C:\program files\emule\incoming\Brutus FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\Norton Anti-Virus 2005 Enterprise Crack.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\winmx\shared\IP Nuker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa\my shared folder\Sub7 2.3 Private.exe runddl32.exe File created C:\program files\icq\shared folder\Half-Life 2 Downloader.exe runddl32.exe File created C:\program files\emule\incoming\Microsoft Visual C++ KeyGen.exe runddl32.exe File created C:\program files\icq\shared folder\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\grokster\my grokster\Microsoft Visual Studio KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\IP Nuker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\morpheus\my shared folder\Windows 2003 Advanced Server KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\limewire\shared\Counter-Strike KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite\my shared folder\Sub7 2.3 Private.exe runddl32.exe File created C:\program files\kazaa lite\my shared folder\Microsoft Visual Studio KeyGen.exe runddl32.exe File created C:\program files\limewire\shared\Microsoft Visual C++ KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\winmx\shared\sdbot with NetBIOS Spread.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Windows Password Cracker.exe runddl32.exe File created C:\program files\emule\incoming\Keylogger.exe runddl32.exe File created C:\program files\winmx\shared\ICQ Hacker.exe runddl32.exe File created C:\program files\winmx\shared\ICQ Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\icq\shared folder\Microsoft Visual C++ KeyGen.exe runddl32.exe File created C:\program files\grokster\my grokster\UT 2003 KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\edonkey2000\incoming\NetBIOS Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\morpheus\my shared folder\NetBIOS Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\NetBIOS Cracker.exe runddl32.exe File created C:\program files\tesla\files\IP Nuker.exe runddl32.exe File created C:\program files\morpheus\my shared folder\Microsoft Visual Basic KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\Hotmail Hacker.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\NetBIOS Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite\my shared folder\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\limewire\shared\Windows Password Cracker.exe runddl32.exe File created C:\program files\kazaa\my shared folder\Half-Life 2 Downloader.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\icq\shared folder\Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\AOL Instant Messenger (AIM) Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\morpheus\my shared folder\Hotmail Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\Microsoft Visual C++ KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\MSN Password Cracker.exe runddl32.exe File created C:\program files\edonkey2000\incoming\MSN Password Cracker.exe runddl32.exe File created C:\program files\morpheus\my shared folder\Brutus FTP Cracker.exe runddl32.exe File created C:\program files\kazaa lite\my shared folder\Website Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\AOL Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\DCOM Exploit.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\Microsoft Visual Studio KeyGen.exe runddl32.exe File created C:\program files\grokster\my grokster\Windows 2003 Advanced Server KeyGen.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\MSN Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\edonkey2000\incoming\Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Microsoft Visual Studio KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\icq\shared folder\NetBIOS Hacker.exe runddl32.exe File created C:\program files\limewire\shared\FTP Cracker.exe runddl32.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\runddl32.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File opened for modification C:\Windows\runddl32.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\Windows\runddl32.exe runddl32.exe - Program crash 2 IoCs
pid pid_target Process procid_target 956 1384 WerFault.exe 87 216 112 WerFault.exe 93 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runddl32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 3602⤵
- Program crash
PID:956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1384 -ip 13841⤵PID:1724
-
C:\Windows\runddl32.exerunddl32.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 3162⤵
- Program crash
PID:216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 112 -ip 1121⤵PID:316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\runddl32.exe
- Size 6KB
- SHA256 54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8
- MD5 45962abd76685d8547238d4f3111e9be
- SHA1 7edb2fa19f390105b4870d7ca79b1b6e5d294db6
- SHA512 409f2067eeb39636e0101b961718db6f572538da133bea872c299e542ed83c0ec07e16e133909d47af2ae138501e4917fce5a59e03c140ecc993342155d74ec8
- SSDEEP 96:H4KnYuRu4Z9j3l0vKv225eItwQe2qwevkEOUyzlFKmdLk:H4KYuRu4ZIQVRwQu9kbUyzll
- TLSH T15BC1B6869DAD9893C43192701601355BBA37B90C06F9CA140F88E52BF8BE8E391FDB53
- MD5 SHA1 SHA512 SSDEEP TLSH