Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 05:47
Behavioral task
behavioral1
Sample
jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe
- Size 36KB
- Sample261002-ggvm5azape
- SHA256 4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d
- MD5 37b12de956420b71b347be807cf7a28b
- SHA1 3783fcb6b0ee30483e5b955645f07ce3408e4f96
- SHA512 c8001e527dd03147a6555c531d2e09283202d356605fca3e1ad44ff52c74fdcf2fd085fdcc82ac041912e5a617ab3963e1a91bff1b5244d4ed2403daae4589db
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eaX5bch:/g7wc1aGNC0klI7CPN3Zch
- TLSH T1EEF26B13E45490B2F49145711988B7226EF9AFB40A5A9143F3806E0EDDBCBDBBB3CD46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 5 IoCs
resource yara_rule behavioral2/memory/4908-0-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/files/0x001e00000000696b-2.dat family_mydoom behavioral2/files/0x000e00000001c50b-12.dat family_mydoom behavioral2/memory/4908-52-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom behavioral2/memory/2728-53-0x0000000000800000-0x000000000080A000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 2728 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\WinRAR.v.3.2.and.key.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\INDUST\Kazaa Lite.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\cy-GB\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Winamp 5.0 (en).com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\WinRAR.v.3.2.and.key.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\Harry Potter.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\Harry Potter.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Winamp 5.0 (en).exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\Kazaa Lite.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\WinRAR.v.3.2.and.key.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\it\index.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0EEA686E-6FCD-4A37-8913-8B000F966285\root\vfs\Windows\assembly\Winamp 5.0 (en).ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\index.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\Kazaa Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\ms-MY\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\te-IN\index.ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\af-ZA\Harry Potter.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\chr-CHER-US\Kazaa Lite.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\or-IN\Harry Potter.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\as-IN\index.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BOLDSTRI\Kazaa Lite.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0EEA686E-6FCD-4A37-8913-8B000F966285\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\index.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\index.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\index.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Harry Potter.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\Kazaa Lite.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\hy-AM\Winamp 5.0 (en).com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ICQ 4 Lite.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\Winamp 5.0 (en) Crack.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\index.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Harry Potter.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0EEA686E-6FCD-4A37-8913-8B000F966285\root\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bs-Latn-BA\Winamp 5.0 (en).com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\pa-IN\Harry Potter.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ug-CN\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\quz-PE\WinRAR.v.3.2.and.key.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\Winamp 5.0 (en).exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\Kazaa Lite.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\0EEA686E-6FCD-4A37-8913-8B000F966285\Kazaa Lite.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\ca-ES\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\Common Files\microsoft shared\ink\kok-IN\index.ShareReactor.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Winamp 5.0 (en) Crack.com jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File created C:\Windows\lsass.exe jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4908
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\bbrf.txt
- Size 3KB
- SHA256 ab64fe2431e4e442358d57095b33a7962700da1462ba4bd28395288773f9d395
- MD5 6f12459175d63950e99de2f04c22a365
- SHA1 2c42259f7a5304a516826c5793e791c2216237f1
- SHA512 9ce374ea081c61da73172a59ff1ae65b50294428d570b2abecd706f2d3b7ef71bca516aa492bbe4b799ce8a7185fe95cf2118a755f6064e794937b79c3b4cc50
- TLSH T14961E5B62E013DAE808960CB1DF7F50F2FB1706C2A402DCB8400139499AE0F88BB387C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp6C0B.tmp
- Size 36KB
- SHA256 74d3053e634f4b5a8268c8282675d445ba000d39b6f45b10cbd7d4e3f6327ee6
- MD5 492d76ad64b0fdf1f1459cd0150fc5a3
- SHA1 cbc21c97d3a029f12b524fe44cd3f90450a11667
- SHA512 8499fdab6e023ce7cf61f01c5f1d327ba65cd0e97150380c4b6936031a3f0117121134c1dc80044abc2348da20ca578488ed1f7d95a7263268c26cf02cd707e9
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3e+X5bcK:/g7wc1aGNC0klI7CPN3BcK
- TLSH T11EF26B13E45490B2F49145711988B7226EF9AFB40A5A9143F3806E0EDDBCBDBBB3CD46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\lsass.exe
- Size 36KB
- SHA256 4078f208687b195140e3bcf6a86f7d8fee535abd3284ba6b42bad595d505d89d
- MD5 37b12de956420b71b347be807cf7a28b
- SHA1 3783fcb6b0ee30483e5b955645f07ce3408e4f96
- SHA512 c8001e527dd03147a6555c531d2e09283202d356605fca3e1ad44ff52c74fdcf2fd085fdcc82ac041912e5a617ab3963e1a91bff1b5244d4ed2403daae4589db
- SSDEEP 768:/EU07c92/EyTAYtxqfGNC0klI7C8yOvi3eaX5bch:/g7wc1aGNC0klI7CPN3Zch
- TLSH T1EEF26B13E45490B2F49145711988B7226EF9AFB40A5A9143F3806E0EDDBCBDBBB3CD46
- MD5 SHA1 SHA512 SSDEEP TLSH