Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/10/2026, 22:21
Behavioral task
behavioral1
Sample
jaffacakes118_Virus.Win32.Lamer.fg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Virus.Win32.Lamer.fg.exe
- Size 830KB
- Sample261015-19rlqaet2j
- SHA256 852d32755516cff48e38cc2f6e0dd93a552d9edcca0ed0aa6baecccf9f24d13f
- MD5 211c448fdf3684ece7853c60518db3ee
- SHA1 521b2500e157c2d61d53d8b94166e6a4ca98a52f
- SHA512 cd26625ad636f12d754bc70ad6f1d6acc3b7680cf7749d2bd343513a4111394aa087b908542721b3850d40b4ee675990441494505e3f09f9625246e0e0cda5a1
- SSDEEP 12288:yxX2H+45a1thOhRTxjQeN/TFxxt1thOhRTxxwildlSz1thOhRTxWRzScwildlSau:yxb45ZrTxjQeN/JirTx6uzDrTxBfuzul
- TLSH T1B4059D0A69D4D471D9A2217205BC6F75A232DCB41B1082CFF3CCD5699B62EC1EBB436B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ktmutil.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\msinfo32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\prevhost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\bthudtask.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\lodctr.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\netsh.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\quickassist.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\relog.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\bootcfg.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\choice.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\eventvwr.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sethc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\tasklist.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\at.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\bitsadmin.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PickerHost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wscript.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\netiougc.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\WerFault.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wscadminui.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dplaysvr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\hdwwiz.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\msiexec.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\rasautou.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sdbinst.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\diskperf.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\OposHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\prevhost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\ROUTE.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\tzutil.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dpapimig.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\TpmInit.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\eventcreate.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\lodctr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\logagent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\msra.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wextract.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\DWWIN.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PATHPING.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\powercfg.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\winrs.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\instnm.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sc.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sort.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sort.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\at.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\autochk.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe -
resource yara_rule behavioral1/memory/4976-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x0005000000022bf2-4.dat upx behavioral1/memory/4976-1314-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4976-1313-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x004f000000024461-1401.dat upx behavioral1/memory/4976-3219-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4976-3220-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4976-3221-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4976-3225-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\7-Zip\7zG.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Mail\wabmig.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe jaffacakes118_Virus.Win32.Lamer.fg.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\n\VmComputeAgent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\f\cleanmgr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.1_none_b0876c2e7a0b3a5f\SpaceAgent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\unregmp2.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\f\Microsoft.AsyncTextService.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\n\AssignedAccessGuard.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\f\FXSSVC.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\MBR2GPT.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1266_none_85eec0307bfb088e\WPDShextAutoplay.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDriveSetup.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\perfmon.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\splwow64.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5643c883846b0513\aspnet_wp.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.1_none_513ebdc8ffa81e3d\coredpussvr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\wuauclt.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_fce141858c5d7f03\IMEWDBLD.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\r\DiskSnapshot.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.1_none_f6e35a697a06e63e\desktopimgdownldr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\r\SndVol.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_5d7644a9644fd29d\ctfmon.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_8e850c52ac392ae6\dw20.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\r\FileExplorer.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorQuickStart.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrm.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\securekernel.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.19041.1_none_de17915d5c62b62d\mqtgsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\f\netbtugc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\smartscreen.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\f\wifitask.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-add.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\attrib.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_0f8992295edbadb4\eudcedit.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpresult.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\wuauclt.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1_none_b354d0155be50ce9\pnputil.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\tttracer.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\f\Taskmgr.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\r\SpaceAgent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\r\rasdial.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\alg.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\iisreset.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-agent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_8be8c2693dde2cd4\TokenBrokerCookies.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\f\LockApp.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\f\sppsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\f\wifitask.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\r\wmpnetwk.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Virus.Win32.Lamer.fg.exe - NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x0005000000022bf2-4.dat nsis_installer_2 behavioral1/files/0x004f000000024461-1401.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Lamer.fg.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Lamer.fg.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.3MB
- SHA256 2798d01a487a9bebcb5c1b9cee0141f75a13f484f00a29ecbcd06f38836a7fbe
- MD5 469b204dd834f7d0aff0dcf1d635529c
- SHA1 3569d7c5d545b13db7877b0b015abe12f7236518
- SHA512 1648d0e05be27219511a08c9eba0db7257084554bf620210a67caf7402b310233db79f018091e5c03306298c35da0e4ab8fe55620251a3d3194093c426947eea
- SSDEEP 24576:yxb45ZrTxjQeN/JirTx6uzDrTxBfuzux0Le5ji0hmxNrM1:yxOZ/9phJi/ZzD/2zuxPji0AjM
- TLSH T1AF658D16F5A4C631D0739075C5E5AB79EA32B8911B3086CFA388D66C6F23BD2C635336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\GrantEnable.bat-
- Size 1.3MB
- SHA256 c898a526b526b39e7e5da4160774dbd4962f20429f206781741fdef5a277057a
- MD5 dc13d54654617dde7a4903e04175102a
- SHA1 0635364533991010e0d49022b12870226ae01727
- SHA512 6abedf1fd2e8668928fbfb09294ccaf5030bd2080cec42df30c6fc6fd07080541c94ddde5c4dacd1fa8008d308e280168138536b487f6c178bf0ceabcba75d58
- SSDEEP 24576:yxb45ZrTxjQeN/JirTx6uzDrTxBfuzusIw6aLGPsJS1VarE+1m0XqB:yxOZ/9phJi/ZzD/2zusyCssrEFB
- TLSH T16455D01A68D0D471D9A2217205BC6F75A232DCB41B1182CFF3CCD6699B62EC1DBB436B
- MD5 SHA1 SHA512 SSDEEP TLSH