Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 12:51
General
- Target jaffacakes118_Virus.Win32.Sality.k.exe
- Size 87KB
- Sample261014-p3wfjsst3k
- SHA256 5b260ced493960105122ace2ba980505f4d2726190822d54462eb81d36b65e90
Score
10/10
Malware Config
Signatures
- Family: MyDoom
MyDoom is a Worm that is written in C++.
- Detects MyDoom family 2 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Sality.k.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 4642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 4722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1748 -ip 17481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3036 -ip 30361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4584 -ip 45841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3036 -ip 30361⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
olemdb32.dll
memory/1748-8-0x00000000004A0000-0x00000000004AD000-memory.dmp
memory/1748-9-0x00000000004A0000-0x00000000004AD000-memory.dmp
memory/3036-0-0x0000000019140000-0x0000000019159000-memory.dmp
memory/3036-7-0x0000000010000000-0x000000001000F000-memory.dmp
memory/3036-16-0x0000000019140000-0x0000000019159000-memory.dmp
memory/4584-11-0x0000000000400000-0x0000000000405000-memory.dmp
memory/4584-13-0x0000000000400000-0x0000000000405000-memory.dmp