Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 05:44
Behavioral task
behavioral1
Sample
jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe
- Size 44KB
- Sample261002-gffskssses
- SHA256 7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384
- MD5 b257806b4d638733d607e15b6e73ffe2
- SHA1 bffc533aac76d07dd1d0f483946773d8abd79edd
- SHA512 9752552647c6836a31ee069537f70a3391365000509138ec6b6f344aa11402d57dd7b4219bedda4382baf0f2ebabcefc228edf96356315c6f57b9c6a3f716450
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3enveCqe+7D4HwXNT4sg:/g7wc1aGNC0klI7CPN3CveAKDRNT4b
- TLSH T1B9234A13E55480A2F68285791D48B6526EFCFFB489DD4102F2841B0DDDBCAC7A738B86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/5180-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x001000000001b846-2.dat family_mydoom behavioral2/files/0x000d00000001c5e4-8.dat family_mydoom behavioral2/memory/5180-50-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/2220-51-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 2220 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RMNSQUE\Harry Potter.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\Winamp 5.0 (en) Crack.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\Winamp 5.0 (en).exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Winamp 5.0 (en).com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\Winamp 5.0 (en) Crack.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\ICQ 4 Lite.ShareReactor.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\Kazaa Lite.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\mi-NZ\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ne-NP\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nn-NO\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\NETWORK\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\km-KH\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\Harry Potter.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\WinRAR.v.3.2.and.key.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\ta-IN\Winamp 5.0 (en).ShareReactor.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\vfs\Windows\Kazaa Lite.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\Winamp 5.0 (en).exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLENDS\WinRAR.v.3.2.and.key.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\ICQ 4 Lite.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\Harry Potter.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\sq-AL\Kazaa Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\Winamp 5.0 (en).exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\vi-VN\Kazaa Lite.ShareReactor.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ESEN\index.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\Kazaa Lite.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\Kazaa Lite.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\ICQ 4 Lite.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\index.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\ICQ 4 Lite.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\Winamp 5.0 (en) Crack.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\vfs\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\am-ET\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Winamp 5.0 (en).exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\CC7EE9A3-1636-4E29-AD87-CA66658FC4CE\root\Kazaa Lite.com jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ms-MY\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\ICQ 4 Lite.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\index.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\Winamp 5.0 (en).exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\Harry Potter.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\Harry Potter.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\index.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe File opened for modification C:\Windows\lsass.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe File created C:\Windows\lsass.exe jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5180
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\gntsyjls.txt
- Size 11KB
- SHA256 a120ae25db572735351ecb43028693d211c3f3d1e25befe13d269ab4ab79a8cb
- MD5 1fdca293b95a43094fe8750f97ab9636
- SHA1 f94160927875abe4faef99d3bc90b886e306674b
- SHA512 b2524e410f8e141e48ef39ec29f50fdaa4ed62800746300ed74f32c593b1ede3d64534053a46f92062b4ae80d5cdf8f1edd6d3dd7863fe18bef3f8a2ddf1b35b
- SSDEEP 192:vXC6g+XPI4R6WMXhCYbjM97Op1HuYJ2C3ljq6JziRjbsoYNEoQ40sj6uuvguBXr9:rJnMU4jw6pcYoKu6JWb1uw7uutrzLN
- TLSH T1D3325CBAAE14352DC18A63D64EF7FC0B6B30386C50C09F4B86506945581E9FDAB3B47C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpC645.tmp
- Size 44KB
- SHA256 12de1c19b67b9b773f7d32a018cf099bf189b4b64728b8354ef36018a5651bb7
- MD5 4ddf5569128b647aa28699797e114e93
- SHA1 d08368c82de2677bfde2b3351f73884ff3c8d6e5
- SHA512 1529e443fef2b35c33dcf4389500a1b477e999967eaf7cd6b275a2f8ced5fbebf79eac819c0ab07c94c9147ffcc13b32d59439f50479016f1d254d1618c2bcea
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3ejveCqe+7D4HwXNT4s4:/g7wc1aGNC0klI7CPN36veAKDRNT4H
- TLSH T1D4234A13E55480A2F69285791D48B6526EFCFFB489DD4102F2841B0DDDBCAC7A738F86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 44KB
- SHA256 7bbae44612859d011b80067e59bef8819de3827d290a9f63a06ff500ebb55384
- MD5 b257806b4d638733d607e15b6e73ffe2
- SHA1 bffc533aac76d07dd1d0f483946773d8abd79edd
- SHA512 9752552647c6836a31ee069537f70a3391365000509138ec6b6f344aa11402d57dd7b4219bedda4382baf0f2ebabcefc228edf96356315c6f57b9c6a3f716450
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3enveCqe+7D4HwXNT4sg:/g7wc1aGNC0klI7CPN3CveAKDRNT4b
- TLSH T1B9234A13E55480A2F68285791D48B6526EFCFFB489DD4102F2841B0DDDBCAC7A738B86
- MD5 SHA1 SHA512 SSDEEP TLSH