Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 05:39
Behavioral task
behavioral1
Sample
jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe
- Size 37KB
- Sample261002-gcefca11dx
- SHA256 839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84
- MD5 94d1cf09f16f83e033867f69db5bbc73
- SHA1 b854355d2e04ae3bbf06836908d0acaac012a40e
- SHA512 31da5bb6cd44e9b828bbd43468adaed754178da756adb388d2061e3872d594234708d0c04b10508365e265957e2cf8124939cdee67df64d8714fd14671869353
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3e5PJEGwFeXpj:/g7wc1aGNC0klI7CPN3wN
- TLSH T19B036B13E45490B2F48285711948B7625EF9EFB44A5A9143F2805B0EDDBCBC7B738E86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/5640-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x0008000000011392-2.dat family_mydoom behavioral2/files/0x000e00000001c4d3-12.dat family_mydoom behavioral2/memory/5640-38-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/1160-54-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 1160 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\WinRAR.v.3.2.and.key.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\WinRAR.v.3.2.and.key.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\dotnet\shared\ICQ 4 Lite.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\index.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\index.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\WinRAR.v.3.2.and.key.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\Winamp 5.0 (en).exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\ICQ 4 Lite.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\Harry Potter.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\gd-GB\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\id-ID\Winamp 5.0 (en) Crack.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\Harry Potter.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\index.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\is-IS\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\Kazaa Lite.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\Winamp 5.0 (en) Crack.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\89698B49-1327-4BAA-8E7A-5BD174EC0C36\root\vfs\Windows\assembly\GAC_MSIL\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\te-IN\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\89698B49-1327-4BAA-8E7A-5BD174EC0C36\root\vfs\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\WinRAR.v.3.2.and.key.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\Winamp 5.0 (en).com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\index.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\89698B49-1327-4BAA-8E7A-5BD174EC0C36\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\gu-IN\Winamp 5.0 (en).com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ICQ 4 Lite.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Winamp 5.0 (en) Crack.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\Winamp 5.0 (en) Crack.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Winamp 5.0 (en).com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\Kazaa Lite.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\VC\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Harry Potter.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\ICQ 4 Lite.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\ICQ 4 Lite.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\index.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\ICQ 4 Lite.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\ne-NP\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\Winamp 5.0 (en).exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\Winamp 5.0 (en) Crack.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ml-IN\index.ShareReactor.com jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File created C:\Windows\lsass.exe jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5640
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Nzjb.txt
- Size 4KB
- SHA256 099dc2f4c1a92aff6635d702855b7dc14de402de7c9b9655f1b3a218ad2fe3d9
- MD5 a534588e3aad78806df7faa93ac726d4
- SHA1 8ab8aaaffefe2827c544b080a5dc4b4b3353e7d8
- SHA512 1df94ba6de822be6ef55a859c12fc5622e6e4abf4cce5d64c66e1b10c51261b1c532ba39971037a4011eb87638638369f17ab5c633f63a64d11709704a434d3b
- SSDEEP 48:vKodkN4PNgvz5eg9w/1Wf2uCoKSWwCNchC7kKTxAygGLAVuQ5zd7BdR2Jqh61TRP:vxJ1gbXegflCoKz3N7y2LQ3bR+0/a
- TLSH T18381C6792F66B22EA50C47CE5EE7F94E672079A965980E7F12211B58350E8F0A33343C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpD162.tmp
- Size 37KB
- SHA256 7d97b66091e77daeb9c00d0b524180e81d546681f8e10c3960344a00e649bd7b
- MD5 8f88b934bf856b8142bf950d5827edc8
- SHA1 26efc12018a9182ce00afd5e98b02304dfb052bf
- SHA512 1e75504319799b5da4d25ae2db456ab9bc52faef9392b4409eba6ada8c3bfe61795daa07a8d5ec199f2af96c37961e330a5dbaae1a038be17b17d4deeaee16b9
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eCPJEGwFeXpj:/g7wc1aGNC0klI7CPN39J
- TLSH T194036B13E45490B2F48285711948B7625EF9EFB44A5A9143F2805B0EDDBCBC7B738E86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 37KB
- SHA256 839b6131089562d93d12b666650539cb96743dfa6a758dae037d42688005da84
- MD5 94d1cf09f16f83e033867f69db5bbc73
- SHA1 b854355d2e04ae3bbf06836908d0acaac012a40e
- SHA512 31da5bb6cd44e9b828bbd43468adaed754178da756adb388d2061e3872d594234708d0c04b10508365e265957e2cf8124939cdee67df64d8714fd14671869353
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3e5PJEGwFeXpj:/g7wc1aGNC0klI7CPN3wN
- TLSH T19B036B13E45490B2F48285711948B7625EF9EFB44A5A9143F2805B0EDDBCBC7B738E86
- MD5 SHA1 SHA512 SSDEEP TLSH