Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:13
Behavioral task
behavioral1
Sample
jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe
- Size 44KB
- Sample260925-vrx3wswwbx
- SHA256 59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f
- MD5 a0948cd8b645e106e3d2e2b92fdcc4ef
- SHA1 ad6d3d64ed539e450f43a5c1726f40f81fb74d11
- SHA512 95f158466e4186bc5f32d2398e7bb34636ccea764e2af422ca4bb5f51ee86dc87cfdae5ff3ccd8050da7cc5cee4828234b68c5e7845af858e64def0221b6831c
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3evKdkSziCUmfM:/g7wc1aGNC0klI7CPN3v2CU4M
- TLSH T1E813AE13A4549073F4C046761699A7776DFA9DB80912A183F7805A0EAEF8BD7BE3CC07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/1060-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x000b000000019cae-2.dat family_mydoom behavioral2/files/0x000e00000001c59b-15.dat family_mydoom behavioral2/memory/1060-49-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/6112-55-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 6112 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\gu-IN\WinRAR.v.3.2.and.key.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fa-IR\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\Kazaa Lite.ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\mr-IN\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\Kazaa Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES-valencia\index.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\Harry Potter.ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\Winamp 5.0 (en).exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Winamp 5.0 (en) Crack.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\Kazaa Lite.ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\gl-ES\Winamp 5.0 (en) Crack.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\id-ID\index.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\Kazaa Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\Harry Potter.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\WinRAR.v.3.2.and.key.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EDGE\Kazaa Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\Winamp 5.0 (en).com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\vi-VN\Winamp 5.0 (en).com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\index.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\Winamp 5.0 (en).ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\lo-LA\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\ICQ 4 Lite.ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\vfs\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Winamp 5.0 (en).ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\Winamp 5.0 (en).exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Winamp 5.0 (en) Crack.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\Harry Potter.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Kazaa Lite.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hy-AM\Winamp 5.0 (en).ShareReactor.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\Harry Potter.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\VGX\ICQ 4 Lite.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Harry Potter.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\index.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\lb-LU\index.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Harry Potter.com jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WinRAR.v.3.2.and.key.exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File created C:\Windows\lsass.exe jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1060
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:6112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\gntsyjls.txt
- Size 11KB
- SHA256 af168ea989adcede1cf74af86a7cc7b382a70350f07d6bd3e0d5f640cf0cfb18
- MD5 39b1e10c9ff14bda215118618cafe7b6
- SHA1 424b4426103f471094f2ac0739669d15237d3b04
- SHA512 92771be792ff3ff3e8eeffb455a11bcb66330af2f979e61e461c87610df098bd926c228f120aa2c0cbcd11883a35bc3aa3f9583d63a666569b404706b4fdda28
- SSDEEP 192:vaWk+wuI4B7f/AWjvr4twMR2XzwSkGos9DJ6cLt1XGW52gYO0CW2a00:ELuI4B7Vj4eMR2XziEDJhtVG62gYNCd0
- TLSH T1A632AF1D51533E66471F6AD7A6AD22051BC0DB34C398DCBDEC3A3D7B13166098C3B2A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp8B43.tmp
- Size 44KB
- SHA256 92e62a691ba6a83f26b5abf34af3bbc565f4f23ad028d31f90e3701b7b67ce9d
- MD5 3eea976b09ab2c59ee249efd96802335
- SHA1 7424bf108cfc9928881fca0c37726ce5a88aa8f6
- SHA512 ccf8d294c5bb8ddc97235200be882e783fecc832f0b36218fc9ad183e3cf3c88f107f431e8ef96eb2b9e8fe7e8066a747b4853c3889157cdcb213b52b765977d
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3e8KdkSziCUmfp:/g7wc1aGNC0klI7CPN362CU4p
- TLSH T15413AE13A4549073F4C046761689A7776DF69DB80912A183F7805A0E9EF8BD7BE3CC07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 44KB
- SHA256 59c81e26ee86ae68e11528b94f8dda449fb1322494e182121367317944a0c67f
- MD5 a0948cd8b645e106e3d2e2b92fdcc4ef
- SHA1 ad6d3d64ed539e450f43a5c1726f40f81fb74d11
- SHA512 95f158466e4186bc5f32d2398e7bb34636ccea764e2af422ca4bb5f51ee86dc87cfdae5ff3ccd8050da7cc5cee4828234b68c5e7845af858e64def0221b6831c
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3evKdkSziCUmfM:/g7wc1aGNC0klI7CPN3v2CU4M
- TLSH T1E813AE13A4549073F4C046761699A7776DFA9DB80912A183F7805A0EAEF8BD7BE3CC07
- MD5 SHA1 SHA512 SSDEEP TLSH