Overview

overview

10

Static

static

10

jaffacakes...59.exe

windows10-2004-x64

10

jaffacakes...59.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 05:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_f3c8cb9d9da85c68930396462b571dade1e65a27abbf8269e3868b929ddd4359.exe
  • Size 40KB
  • Sample261002-gknzraswhy
  • SHA256 f3c8cb9d9da85c68930396462b571dade1e65a27abbf8269e3868b929ddd4359
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverymydoompersistenceupxworm

Malware Config

Signatures

  • Family: MyDoom

    MyDoom is a Worm that is written in C++.

    wormmydoom
  • Detects MyDoom family 3 IoCs
  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 6 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f3c8cb9d9da85c68930396462b571dade1e65a27abbf8269e3868b929ddd4359.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f3c8cb9d9da85c68930396462b571dade1e65a27abbf8269e3868b929ddd4359.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:696
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4660
  • C:\Windows\services.exe
    C:\Windows\services.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1868
  • C:\Windows\java.exe
    C:\Windows\java.exe
    1⤵
    • Executes a file named after a Windows system binary
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\services.exe
      "C:\Users\Admin\AppData\Local\Temp\services.exe"
      2⤵
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      PID:4712
  • C:\Users\Admin\AppData\Local\Temp\services.exe
    C:\Users\Admin\AppData\Local\Temp\services.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    PID:1664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
        • Size 471B
        • SHA256 9edfb873015e8e3a766e02302c7ab601aea20b49c27d53a2cf77693fd2482459
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97C
        • Size 420B
        • SHA256 1ff28f37b99eb09fe3835de452941294653ea0cf40bd04914ff682fcf0cdaee8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDTSLS6U\search[2].htm
        • Size 123KB
        • SHA256 270e76aef1e4d64efe60256dd24168feec4358d7e58ab13c4b135be84a19ad7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JM3B5PQV\search[1].htm
        • Size 140KB
        • SHA256 a17cf38b454df3904ca6fd8dc0d232082f11afdeb8a48b8aa7b5ee9c4d7bdfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JM3B5PQV\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JM3B5PQV\search[3].htm
        • Size 155KB
        • SHA256 be30f5231202e7f1f6f24cb459bf79515a3c78e25fddf8a21c70f015814277d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KNMT30O2\search[2].htm
        • Size 156KB
        • SHA256 4eb8759edd0ced50978262f8fca84137f6d13396890f369ba66d4b713776ee7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUSZXXV9\search[1].htm
        • Size 155KB
        • SHA256 18a69b6903685c4075e3f4fa0890295a95d1d0b1f35bf204edf7ffd8c0da5286
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9Hejsk.log
        • Path C:\Users\Admin\AppData\Local\Temp\9Hejsk.log
        • Size 1KB
        • SHA256 98063f1c82f4663713a82207c9ef853157068a52c3cd7c8d78395c8e58df1f78
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tmp4F51.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp4F51.tmp
        • Size 40KB
        • SHA256 627d4cb5ae6f54878075a0c300c6c374658a2f4fac764fe3ba25a967af7f8f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 abeafae95a06008a491f13df954a4e2aa1b6b7d1b0b866fa1e5b630f76739bd2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 a4b509e3141c17e63e297c213b01724dc0d7ce92a8c819503c98a87abc98d162
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 e0e8c0b41997c0829d5790bab260a00755ef560348c518fbb52e9798c350bb36
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 d550b09a3b64ca6ccbb3098551ff5a657855c253db9ab140585a17ad92a34005
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 92f0e1c1c828316ca94cffa13f7a69f93c4e414bb737d507e16b146df31a038b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 32B
        • SHA256 cbc7d527504b4c0802ef0e2e05995e057a72486ade053821809b1cca6702572a
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 215cc3134568ecfda675039f71f99cbf87f251c104b55d55054fa49a5395f1eb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 2c48d29b612e87798de9478cb3403882df02d75fdcca20e50c3f37e90680d2c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 57b1736f4a64c886a43247ab9a607352acfbcf076561e360bfda98f67d076d54
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        java.exe
        • Path C:\Windows\java.exe
        • Size 40KB
        • SHA256 f3c8cb9d9da85c68930396462b571dade1e65a27abbf8269e3868b929ddd4359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/696-0-0x0000000000500000-0x000000000050D000-memory.dmp
        Download

        memory/1664-37-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1868-33-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-95-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-197-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-111-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-140-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-105-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-170-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-176-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-180-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-50-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-118-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-279-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-32-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-254-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4660-269-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4712-35-0x0000000000400000-0x0000000000408000-memory.dmp
        Download