Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
- Size 6KB
- Sample260925-2m2nvaycja
- SHA256 54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8
- MD5 45962abd76685d8547238d4f3111e9be
- SHA1 7edb2fa19f390105b4870d7ca79b1b6e5d294db6
- SHA512 409f2067eeb39636e0101b961718db6f572538da133bea872c299e542ed83c0ec07e16e133909d47af2ae138501e4917fce5a59e03c140ecc993342155d74ec8
- SSDEEP 96:H4KnYuRu4Z9j3l0vKv225eItwQe2qwevkEOUyzlFKmdLk:H4KYuRu4ZIQVRwQu9kbUyzll
- TLSH T15BC1B6869DAD9893C43192701601355BBA37B90C06F9CA140F88E52BF8BE8E391FDB53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4568 runddl32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsock startup = "runddl32.exe" jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winsock startup = "runddl32.exe" runddl32.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\tesla\files\AOL Instant Messenger (AIM) Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\Keylogger.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa\my shared folder\MSN Password Cracker.exe runddl32.exe File created C:\program files\edonkey2000\incoming\FTP Cracker.exe runddl32.exe File created C:\program files\icq\shared folder\Half-Life 2 Downloader.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\icq\shared folder\sdbot with NetBIOS Spread.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Hotmail Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\limewire\shared\FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\limewire\shared\AOL Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\Microsoft Visual Basic KeyGen.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\Counter-Strike KeyGen.exe runddl32.exe File created C:\program files\edonkey2000\incoming\Website Hacker.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\UT 2003 KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\Hotmail Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\Counter-Strike KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\edonkey2000\incoming\NetBIOS Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite\my shared folder\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\tesla\files\Windows Password Cracker.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\Brutus FTP Cracker.exe runddl32.exe File created C:\program files\grokster\my grokster\Windows Password Cracker.exe runddl32.exe File created C:\program files\emule\incoming\NetBIOS Cracker.exe runddl32.exe File created C:\program files\limewire\shared\Brutus FTP Cracker.exe runddl32.exe File created C:\program files\tesla\files\DCOM Exploit.exe runddl32.exe File created C:\program files\kazaa\my shared folder\NetBIOS Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa\my shared folder\AOL Instant Messenger (AIM) Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\winmx\shared\AOL Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\AOL Instant Messenger (AIM) Hacker.exe runddl32.exe File created C:\program files\morpheus\my shared folder\Microsoft Visual Studio KeyGen.exe runddl32.exe File created C:\program files\tesla\files\Hotmail Cracker.exe runddl32.exe File created C:\program files\icq\shared folder\AOL Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\limewire\shared\Brutus FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\ICQ Hacker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa lite k++\my shared folder\ICQ Hacker.exe runddl32.exe File created C:\program files\limewire\shared\UT 2003 KeyGen.exe runddl32.exe File created C:\program files\limewire\shared\NetBIOS Hacker.exe runddl32.exe File created C:\program files\kazaa\my shared folder\Microsoft Visual Studio KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\morpheus\my shared folder\FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\kazaa\my shared folder\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\icq\shared folder\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\morpheus\my shared folder\ICQ Hacker.exe runddl32.exe File created C:\program files\kazaa\my shared folder\Counter-Strike KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\bearshare\shared\Keylogger.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Keylogger.exe runddl32.exe File created C:\program files\morpheus\my shared folder\NetBIOS Hacker.exe runddl32.exe File created C:\program files\limewire\shared\Website Hacker.exe runddl32.exe File created C:\program files\kazaa lite k++\my shared folder\Microsoft Visual Studio KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\Brutus FTP Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\grokster\my grokster\Norton Anti-Virus 2005 Enterprise Crack.exe runddl32.exe File created C:\program files\grokster\my grokster\L0pht 4.0 Windows Password Cracker.exe runddl32.exe File created C:\program files\bearshare\shared\Microsoft Visual C++ KeyGen.exe runddl32.exe File created C:\program files\morpheus\my shared folder\Sub7 2.3 Private.exe runddl32.exe File created C:\program files\edonkey2000\incoming\L0pht 4.0 Windows Password Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\DCOM Exploit.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\emule\incoming\Counter-Strike KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\NetBIOS Cracker.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\icq\shared folder\Microsoft Visual Studio KeyGen.exe runddl32.exe File created C:\program files\grokster\my grokster\Half-Life 2 Downloader.exe runddl32.exe File created C:\program files\grokster\my grokster\ICQ Hacker.exe runddl32.exe File created C:\program files\bearshare\shared\Counter-Strike KeyGen.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\program files\tesla\files\sdbot with NetBIOS Spread.exe runddl32.exe File created C:\program files\winmx\shared\DCOM Exploit.exe runddl32.exe File created C:\program files\edonkey2000\incoming\Windows Password Cracker.exe runddl32.exe File created C:\program files\limewire\shared\Hotmail Cracker.exe runddl32.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\runddl32.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File opened for modification C:\Windows\runddl32.exe jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe File created C:\Windows\runddl32.exe runddl32.exe - Program crash 2 IoCs
pid pid_target Process procid_target 3372 5956 WerFault.exe 87 3108 4568 WerFault.exe 92 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runddl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 4242⤵
- Program crash
PID:3372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5956 -ip 59561⤵PID:3392
-
C:\Windows\runddl32.exerunddl32.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 3802⤵
- Program crash
PID:3108
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4568 -ip 45681⤵PID:1784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\runddl32.exe
- Size 6KB
- SHA256 54450caa8ac6adcbfb3e58946d20f6ddb272f6f0a89d37c81ad58467eedfc8b8
- MD5 45962abd76685d8547238d4f3111e9be
- SHA1 7edb2fa19f390105b4870d7ca79b1b6e5d294db6
- SHA512 409f2067eeb39636e0101b961718db6f572538da133bea872c299e542ed83c0ec07e16e133909d47af2ae138501e4917fce5a59e03c140ecc993342155d74ec8
- SSDEEP 96:H4KnYuRu4Z9j3l0vKv225eItwQe2qwevkEOUyzlFKmdLk:H4KYuRu4ZIQVRwQu9kbUyzll
- TLSH T15BC1B6869DAD9893C43192701601355BBA37B90C06F9CA140F88E52BF8BE8E391FDB53
- MD5 SHA1 SHA512 SSDEEP TLSH