Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 05:45
Behavioral task
behavioral1
Sample
jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe
- Size 54KB
- Sample261002-gf6c8sste1
- SHA256 9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83
- MD5 60b4c6673c7a025397cec014afaf43a5
- SHA1 bce9041dcd30623e9f0bf7102bc74e960db4fa51
- SHA512 ba5ba25854a19fceac6a40222c26a2c0f4e15277927b64e28b3191ad4e7e9365b9ec80b2b94570b9acfb46ab30d32266e0a4a7448542ac346ad2ace2a10bcf90
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3ildJjytUZatZwk:I7wc1aOCo7C13ildJkZwk
- TLSH T19B43BE23B4688073F48041B60659A7677EF5AD780A229183F7806E4DDDB8BD3BA3CD57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 4 IoCs
resource yara_rule behavioral1/memory/4428-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral1/files/0x0018000000024397-3.dat family_mydoom behavioral1/memory/4428-280-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral1/memory/4028-294-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 4028 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\en-US\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\Kazaa Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Winamp 5.0 (en).exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\85B50A76-7B3C-4BF5-B25F-818857571598\Winamp 5.0 (en).ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\index.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ICQ 4 Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\Winamp 5.0 (en) Crack.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WinRAR.v.3.2.and.key.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\Harry Potter.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\Kazaa Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\index.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICQ 4 Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\Winamp 5.0 (en) Crack.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\Harry Potter.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\WinRAR.v.3.2.and.key.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\WinRAR.v.3.2.and.key.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\Harry Potter.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\ICQ 4 Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\index.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\Kazaa Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ICQ 4 Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\Kazaa Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Kazaa Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\ICQ 4 Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Winamp 5.0 (en).com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\Winamp 5.0 (en).ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Kazaa Lite.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\index.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ICQ 4 Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ICQ 4 Lite.ShareReactor.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\WinRAR.v.3.2.and.key.com jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\Winamp 5.0 (en).exe lsass.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File created C:\Windows\lsass.exe jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4428
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wssLimpi.txt
- Size 21KB
- SHA256 5c4b863c381216f0b847a16ac6fc774006bf84b08c17b53f54f112947784505e
- MD5 94118dc3ca3126dfbabdd596a72293dc
- SHA1 103f353944fe967a8535814fc1a14e1ec264ac17
- SHA512 c1b656e75fb1b6aa983a27f1e6989d0a0679f0982d3b7ea1abad8311e3a2d94c704a2d6b497ea9a2d6b5d9c05923c73d5dda362d739ffed94aca1dcfc7d84262
- SSDEEP 384:2NceH7KevRZ6MYgsQ5b9bzBhF5PYk4lJfNRaXI0aZISvKGLe:Bo7K6YF+bLzYF1RMI0aKSvq
- TLSH T181A2BFBF54C1B1AA8E5B2F56051F514C0040EF2AC699EEF648665FD3233F2E6BB0E490
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 54KB
- SHA256 9fb898aa9a950c107a0c9d33927d4043601a95e2d76787d7ebd5aaafb908ed83
- MD5 60b4c6673c7a025397cec014afaf43a5
- SHA1 bce9041dcd30623e9f0bf7102bc74e960db4fa51
- SHA512 ba5ba25854a19fceac6a40222c26a2c0f4e15277927b64e28b3191ad4e7e9365b9ec80b2b94570b9acfb46ab30d32266e0a4a7448542ac346ad2ace2a10bcf90
- SSDEEP 1536:/g7wc1aGNC0klI7CPN3ildJjytUZatZwk:I7wc1aOCo7C13ildJkZwk
- TLSH T19B43BE23B4688073F48041B60659A7677EF5AD780A229183F7806E4DDDB8BD3BA3CD57
- MD5 SHA1 SHA512 SSDEEP TLSH