Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 05:39
Behavioral task
behavioral1
Sample
jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe
- Size 34KB
- Sample261002-gcclra11cs
- SHA256 fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574
- MD5 eecb2f2a593183ab9a4c7b56211261bd
- SHA1 68ca893b9ec349cdb6d7072565dc04027c4cc356
- SHA512 2ed7bacd534e6ceafdd2bfa5ebbd03e6da4eca82959489edf7d282ed6152bc23cabe8a9bcd3a51ce73ab545c4736db30f13b59022c7cd79dad2cbad3655af6bc
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3egnHz:/g7wc1aGNC0klI7CPN3RHz
- TLSH T1E8F26C13B4599072F4C046711A88AB635DFAAD740A16A183F7806E4EDDB8BD7FA3CD07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/3288-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x000700000001b859-2.dat family_mydoom behavioral2/files/0x000d00000001c685-8.dat family_mydoom behavioral2/memory/3288-46-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/4668-60-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 4668 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\ICQ 4 Lite.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\WinRAR.v.3.2.and.key.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\kn-IN\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\WinRAR.v.3.2.and.key.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\index.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\Kazaa Lite.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\ICQ 4 Lite.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Harry Potter.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\index.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Harry Potter.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WinRAR.v.3.2.and.key.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\Winamp 5.0 (en) Crack.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\ms-MY\Winamp 5.0 (en).exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ICQ 4 Lite.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Kazaa Lite.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\ICQ 4 Lite.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\index.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VGX\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\ICQ 4 Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\WinRAR.v.3.2.and.key.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\Kazaa Lite.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Harry Potter.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\Kazaa Lite.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\Winamp 5.0 (en) Crack.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ka-GE\WinRAR.v.3.2.and.key.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\ICQ 4 Lite.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WinRAR.v.3.2.and.key.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\mt-MT\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\WinRAR.v.3.2.and.key.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\ICQ 4 Lite.ShareReactor.com jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Kazaa Lite.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\ICQ 4 Lite.ShareReactor.com lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\lsass.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File created C:\Windows\lsass.exe jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe File opened for modification C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3288
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\gntsyjls.txt
- Size 1KB
- SHA256 d58f3a00fbd2093847d3328a551db7099d4a5b408370c15cb4cea27e89e7e4d4
- MD5 67c5ca47595a74ce2749ccf5e0e8b764
- SHA1 c8ecbf8730ba201b0cd781f20057dd1579f361bc
- SHA512 194c3d98a313433e3ea1fae4ce3b1ad2da0ce537619170aa59c73ae84bcc013299741e87f8164d3169a825a77f3e0f533f8aa24c475ac33231b3057ebc3f7e56
- TLSH T11311D817C666B609BE300D05A01E2D5592EFC2BB976C2D90D0E873DC8B21011549F4D0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpE5B4.tmp
- Size 34KB
- SHA256 8449397553341c59ae77637a94ff2543d580cd00fb8052bede59b1095ad8d810
- MD5 eb41c030990d0039972bfd88d99ef9f2
- SHA1 8bd0d3110051d88949ea411646bf90c15ae8f664
- SHA512 7648ed1d6d3c596395819427d9bc9520fa723d62cc3af99ba637c410941a5b7bc5552819fecb029067203c31f0d8290403f15abb4c478254ba387453c8e371f7
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eDnH1:/g7wc1aGNC0klI7CPN3+H1
- TLSH T12CF26C13B4599072F4C046711A88AB635DFAAD740A16A183F7806E4EDDB8BD7FA3CD07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 34KB
- SHA256 fc88cd907e251b1a240c62bcc913b1cb30fe2c1ce229254b17a125c9fa5c6574
- MD5 eecb2f2a593183ab9a4c7b56211261bd
- SHA1 68ca893b9ec349cdb6d7072565dc04027c4cc356
- SHA512 2ed7bacd534e6ceafdd2bfa5ebbd03e6da4eca82959489edf7d282ed6152bc23cabe8a9bcd3a51ce73ab545c4736db30f13b59022c7cd79dad2cbad3655af6bc
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3egnHz:/g7wc1aGNC0klI7CPN3RHz
- TLSH T1E8F26C13B4599072F4C046711A88AB635DFAAD740A16A183F7806E4EDDB8BD7FA3CD07
- MD5 SHA1 SHA512 SSDEEP TLSH