Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 07:55
Behavioral task
behavioral1
Sample
jaffacakes118_P2P-Worm.Win32.Picsys.c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_P2P-Worm.Win32.Picsys.c.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118_P2P-Worm.Win32.Picsys.c.exe
- Size 68KB
- Sample261014-jsfz8aas8l
- SHA256 f4afdfed9c934cf0a6b4e19696ed3f317a502abe54ff69f9321ce186a7640a79
- MD5 31eb26bac6552eaec31548d5dc67f0ac
- SHA1 5337959f1f22fc038139afa70f636f027ba038bb
- SHA512 84ab82bf6fdbfc2e7d6185c78fdc70824624d3b7476e3d27adba0b5a5692428874173d044d311ace415cdd982cb97fd5206d870840432047ec2087c43f169c24
- SSDEEP 1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMS3Utkf2:5JjcF8KfCOcjk+guPVjS3l2
- TLSH T1A06302F5FAAE9E52E4838BFD555FA7C7134AAFC2063B2A5C4D72685420D10E7483A037
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" jaffacakes118_P2P-Worm.Win32.Picsys.c.exe - Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\sluts who are in control of their slaves.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\porn account cracker.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\horny teen waking up with her pink pussy spread.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\two hot college girl fucking in class.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\winxcfg.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\sunbathing beauties tanning tender pussy lips.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\sexy little blonde teasing.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\hot babe getting pussy eaten by horny girlfriend.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\two large black bones in a small white box.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\cute teen with her hole spread wide open.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\Microsoft Office XP (english) key generator.exe jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\firm ass honie with thick lips made for sucking rods.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\some hard sucking and fucking babes.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe File created C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif jaffacakes118_P2P-Worm.Win32.Picsys.c.exe -
resource yara_rule behavioral2/memory/1232-0-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/files/0x000d00000001c53e-5.dat upx behavioral2/memory/1232-35-0x0000000000400000-0x0000000000467000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_P2P-Worm.Win32.Picsys.c.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\macromd\Microsoft Office XP (english) key generator.exe
- Size 76KB
- SHA256 a0e21ba978c4436aa8c3e10ca5d4e637837d62eccb7dabdaf08d8e69d6a9407b
- MD5 5b710627a19cbfe85ab363ec7a99ce10
- SHA1 4d2c96e03d800ea17afab664a438dbbc89765016
- SHA512 823785014392891fe4aa5a57a6a86ca1e4e29245f5c4631abdc5e52d84bde6f16e076c01833b686f398ad127dfcb3a35a7d4c370f409324e140d1f9cd723deb6
- SSDEEP 1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSTby3Qr:5JjcF8KfCOcjk+guPVjSqq
- TLSH T12B7312F4EAEDDE12E4834FF5521BD796122EFECA1925367C8C11996814C21E6883B03F
- MD5 SHA1 SHA512 SSDEEP TLSH