Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 05:45
Behavioral task
behavioral1
Sample
jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe
- Size 57KB
- Sample261002-gf4jmsstes
- SHA256 15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f
- MD5 0f8bf197220c3300c5bc40cbbc800937
- SHA1 df1a8ea14edf215abfec1332454fa6cec96062b8
- SHA512 8dded1096cd0379b89da4c31eded87b86652f5e1db5b45db90483f1a4984ca0046a7161f40c40b3704753e98538a668bff8be64b31fed9630708249717e0027d
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3fE+h4rOx6XMfGLX:I7wc1aOCo7C13flOrOMXuy
- TLSH T15843CF23B4A59073F88041760945AB767DFAED780956A183F6805E0DDEB8BEB773CC12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/4700-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x001900000001151c-2.dat family_mydoom behavioral2/files/0x000e00000001c5b3-11.dat family_mydoom behavioral2/memory/4700-49-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/4756-50-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 4756 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\tt-RU\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\ICQ 4 Lite.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Harry Potter.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EXPEDITN\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\Kazaa Lite.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Kazaa Lite.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\ICQ 4 Lite.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\Winamp 5.0 (en) Crack.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Kazaa Lite.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\Harry Potter.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\WinRAR.v.3.2.and.key.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\index.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\tr\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\Winamp 5.0 (en) Crack.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\ICQ 4 Lite.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\sq-AL\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\ICQ 4 Lite.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\Winamp 5.0 (en).exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\ga-IE\Harry Potter.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\Harry Potter.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\Kazaa Lite.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENES\Harry Potter.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\index.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\Winamp 5.0 (en) Crack.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\WinRAR.v.3.2.and.key.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\hy-AM\Winamp 5.0 (en).exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\ICQ 4 Lite.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\WinRAR.v.3.2.and.key.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\index.ShareReactor.com jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\ICQ 4 Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\ICQ 4 Lite.exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File created C:\Windows\lsass.exe jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4700
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmp7AE5.tmp
- Size 57KB
- SHA256 f0a60a24e2419e0b5817a5154d83643bc3991a511de043015dec5e0b76ae3082
- MD5 6718c89f10f2c5d7c9f6fc043e540086
- SHA1 789c6b8626147a16f2d4f421ec823d0e7c8505ed
- SHA512 5dbd0398e5882f59d4c3008637fd0b7900706f9be52fb5986327ddee3187cf212e4ae647cf07279478398cb5d35c541ec4391b800f15bf1253930fe301e8b091
- SSDEEP 1536:/g7wc1aGNC0klI7CPN31E+h4rOx6XMfGL3:I7wc1aOCo7C131lOrOMXuO
- TLSH T16643CF23B4A59073F88041760945AB767DFAED780956A183F6805E0DDEB8BEB773CC12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zkmoEyvnxs.txt
- Size 24KB
- SHA256 0240db4015ef080ed0d814adee42e0cecf7d85160ffce19e2503606bfd247cad
- MD5 0d2db094933d07de6a4822ab59f98598
- SHA1 cbaa93c2ffd77c37a04ae347dd476d7ec4d81a91
- SHA512 0fd4d5db1073bd6e2e66b49f9861620dd4235247fa9e555c3d7f7b7d7f9644525e4f0eb8738503566421487e1b702e256aa295d1a4286933ba0bd4afc0f16d8b
- SSDEEP 384:VpN0vDygYe1UmmogKJuYcLWjsLCaYL+WSHX90NyKBy0cEFuGSJ9enmIJMthIPJ:SLzOmSKJRSwXaOeX9Wy0rIJ0ko
- TLSH T1B8B2D02CA451BA8C9EBA6BDB25BF185523ECD567D378D1F305A9B2BF0A0F0011C8D062
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 57KB
- SHA256 15560c1d95db5c3e9a2c4e4dc9a9283eeae282c91cc65a6e6772b1b17563326f
- MD5 0f8bf197220c3300c5bc40cbbc800937
- SHA1 df1a8ea14edf215abfec1332454fa6cec96062b8
- SHA512 8dded1096cd0379b89da4c31eded87b86652f5e1db5b45db90483f1a4984ca0046a7161f40c40b3704753e98538a668bff8be64b31fed9630708249717e0027d
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3fE+h4rOx6XMfGLX:I7wc1aOCo7C13flOrOMXuy
- TLSH T15843CF23B4A59073F88041760945AB767DFAED780956A183F6805E0DDEB8BEB773CC12
- MD5 SHA1 SHA512 SSDEEP TLSH