Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 05:40
Behavioral task
behavioral1
Sample
jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe
- Size 62KB
- Sample261002-gdbe3saa93
- SHA256 072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7
- MD5 a3cb67e2c5d705a4b3a0eb99d533fde3
- SHA1 6ab3090db7bf0093c4af6cfee3dcee527af0111e
- SHA512 e42042e2e930bf6c95103a689e3a1297ec773447403ba97feda9407e6b25a71abe5a5a8f7037755a36ad812bffd85afd666028c3b5b9e3fb10327c976c6b49bf
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3DjX1LulwiWQA/fQpCgAW:I7wc1aOCo7C13fEpWQkf7gN
- TLSH T10753D023A4999033F48142790618AB6A7EF68C7C49955293F6805F0D9DF4FCBFA3CC66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 4 IoCs
resource yara_rule behavioral1/memory/1028-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral1/files/0x00170000000243b3-3.dat family_mydoom behavioral1/memory/1028-288-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral1/memory/4120-289-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 4120 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Winamp 5.0 (en) Crack.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\Harry Potter.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\Harry Potter.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\Winamp 5.0 (en) Crack.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\index.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WinRAR.v.3.2.and.key.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\Winamp 5.0 (en).com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\VC\index.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\ICQ 4 Lite.ShareReactor.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Kazaa Lite.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\Winamp 5.0 (en) Crack.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Winamp 5.0 (en).com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\index.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Harry Potter.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\Harry Potter.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Triedit\en-US\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\Winamp 5.0 (en).ShareReactor.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\index.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\WinRAR.v.3.2.and.key.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ICQ 4 Lite.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Winamp 5.0 (en) Crack.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Harry Potter.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\index.ShareReactor.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\Harry Potter.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\ICQ 4 Lite.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RICEPAPR\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Harry Potter.ShareReactor.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\Winamp 5.0 (en).exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\Kazaa Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Kazaa Lite.com jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\index.exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File created C:\Windows\lsass.exe jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1028
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\umocjrcwc.txt
- Size 29KB
- SHA256 e6b7c52518c61cff01e38357d71845a7a31b02e4cc3bac445cb5b3b6a1c89cca
- MD5 326219bc494b8275f4946cfc456cdea0
- SHA1 0220be601523e237d6dc69ea3ba6407ba02b0bfe
- SHA512 98e88e2140ac419b1018cef1b35532d6c7e31c23e29a41cf562c524a85250f335027c386d944bd192096eb8f603ea67dedb095d288227b506cd85d9597948bc9
- SSDEEP 768:gJcM7t4cozD+XLyEY1EwNvO7Mt4vGUOfQiTNoyTh:Et4cozDupwNvO7MwiTNd
- TLSH T1DCD2DF3DA0C13D7AE75D3BA4025AB52533E81A3AC7CC83A6F0B71E9B571F4991C21326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 62KB
- SHA256 072e3bf70a3830a307102558afad66beac4cd80a52a880557ded445f562ac3c7
- MD5 a3cb67e2c5d705a4b3a0eb99d533fde3
- SHA1 6ab3090db7bf0093c4af6cfee3dcee527af0111e
- SHA512 e42042e2e930bf6c95103a689e3a1297ec773447403ba97feda9407e6b25a71abe5a5a8f7037755a36ad812bffd85afd666028c3b5b9e3fb10327c976c6b49bf
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3DjX1LulwiWQA/fQpCgAW:I7wc1aOCo7C13fEpWQkf7gN
- TLSH T10753D023A4999033F48142790618AB6A7EF68C7C49955293F6805F0D9DF4FCBFA3CC66
- MD5 SHA1 SHA512 SSDEEP TLSH