Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:13
Behavioral task
behavioral1
Sample
jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe
- Size 34KB
- Sample260925-vrnjfss15n
- SHA256 b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf
- MD5 c75b48f58f7e1d58364e584011894850
- SHA1 6ce3346d8d5f64014f43e51dad8d689f1903ae6d
- SHA512 7cd7dc05c6ed0d15f51c17a2188a40f0e8b6ff921d7670f68a26fed860f19d427ed2961d033ed68a45559be42b0bb7445dc88692175f47e28394d24c56a02d54
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eVFt:/g7wc1aGNC0klI7CPN3E
- TLSH T168F27C13A4589072F4C046711948AB676EF9AF740A16A183F3806E4EDDB8BD7FA3CD47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/4560-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x0007000000016b3b-2.dat family_mydoom behavioral2/files/0x000d00000001c5f6-15.dat family_mydoom behavioral2/memory/4560-49-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/1712-50-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 1712 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ICQ 4 Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\Harry Potter.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Kazaa Lite.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\index.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ICQ 4 Lite.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\ICQ 4 Lite.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\WinRAR.v.3.2.and.key.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\index.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\index.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Kazaa Lite.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Kazaa Lite.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Winamp 5.0 (en) Crack.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\Winamp 5.0 (en).exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\hy-AM\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Winamp 5.0 (en).exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\lb-LU\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\Winamp 5.0 (en) Crack.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Kazaa Lite.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\vi-VN\WinRAR.v.3.2.and.key.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Kazaa Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\WinRAR.v.3.2.and.key.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\index.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\WinRAR.v.3.2.and.key.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\ink\kn-IN\index.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\fr\Harry Potter.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\Harry Potter.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ICQ 4 Lite.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Kazaa Lite.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WinRAR.v.3.2.and.key.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Kazaa Lite.ShareReactor.com jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\lsass.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File created C:\Windows\lsass.exe jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe File opened for modification C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4560
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\gntsyjls.txt
- Size 1KB
- SHA256 0e7dc6456c21951b56891df8ef6bc01cf532938fd4d428ce9de35d7556a18287
- MD5 45ae666e721be91e9f37ed1ea7b77c25
- SHA1 c69b6fb3f1edad1f884100f3cd57433e03352378
- SHA512 4a42f88423a6d8c9a81d4ddfdf0ff8ce6f251e0821e7ec8207b1f0c73988bb9ff034b9fc534aaa05469c2db6d61b95cb15950ae9215b42543e43b70d4644166c
- TLSH T15A1150B39E54294C9A08A6CA8CEBF18AEA80AACC01C29C9752306D5624677F9133343C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpBD7E.tmp
- Size 34KB
- SHA256 ca2cf28611e84982c72d1ea10ab420431a4fdcc670626f6a8e50bc571532f517
- MD5 1e2f2e4f6ed69e444e82e1f8e18d4c40
- SHA1 22506581f6a0537e6bcae875d09e75f66dc9d9d5
- SHA512 3500db0c026192de27bfe08bfa18bb2f427f3750c5e09596042fe7882e3f5e966830af08c992eb83cc24d6a677bd66f7058cdf964e2cc37bd262d0b47bbb8759
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eNFz:/g7wc1aGNC0klI7CPN3+
- TLSH T159F27C13A4589072F4C046711948AB676EF9AF740A16A183F3806E4EDDB8BD7FA3CD47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 34KB
- SHA256 b3773889f888a291ce5a5e0d343c2fbb11c9f52523aad6ed2b4ac189fb26f7bf
- MD5 c75b48f58f7e1d58364e584011894850
- SHA1 6ce3346d8d5f64014f43e51dad8d689f1903ae6d
- SHA512 7cd7dc05c6ed0d15f51c17a2188a40f0e8b6ff921d7670f68a26fed860f19d427ed2961d033ed68a45559be42b0bb7445dc88692175f47e28394d24c56a02d54
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eVFt:/g7wc1aGNC0klI7CPN3E
- TLSH T168F27C13A4589072F4C046711948AB676EF9AF740A16A183F3806E4EDDB8BD7FA3CD47
- MD5 SHA1 SHA512 SSDEEP TLSH