Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 22:21
Behavioral task
behavioral1
Sample
jaffacakes118_Virus.Win32.Lamer.fg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Virus.Win32.Lamer.fg.exe
- Size 830KB
- Sample261015-19rlqaet2j
- SHA256 852d32755516cff48e38cc2f6e0dd93a552d9edcca0ed0aa6baecccf9f24d13f
- MD5 211c448fdf3684ece7853c60518db3ee
- SHA1 521b2500e157c2d61d53d8b94166e6a4ca98a52f
- SHA512 cd26625ad636f12d754bc70ad6f1d6acc3b7680cf7749d2bd343513a4111394aa087b908542721b3850d40b4ee675990441494505e3f09f9625246e0e0cda5a1
- SSDEEP 12288:yxX2H+45a1thOhRTxjQeN/TFxxt1thOhRTxxwildlSz1thOhRTxWRzScwildlSau:yxb45ZrTxjQeN/JirTx6uzDrTxBfuzul
- TLSH T1B4059D0A69D4D471D9A2217205BC6F75A232DCB41B1082CFF3CCD5699B62EC1EBB436B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Com\MigRegDB.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\RdpSa.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\scrnsave.scr- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\svchost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\convert.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dfrgui.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\ntprint.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\OpenWith.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\pcaui.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\perfhost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\regedt32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\regedit.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\attrib.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\forfiles.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\getmac.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\proquota.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Robocopy.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\iexpress.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Taskmgr.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\where.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wiaacmgr.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\mcbuilder.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\mspaint.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PATHPING.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wextract.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wowreg32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\explorer.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\explorer.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dialer.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\mmc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\runas.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\auditpol.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\bthudtask.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\certutil.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\netiougc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\regedt32.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\Fondue.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\WerFault.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\clip.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\cscript.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\dpapimig.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\TRACERT.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wowreg32.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\wscript.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\sort.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\certreq.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\cmdkey.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\diskusage.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe jaffacakes118_Virus.Win32.Lamer.fg.exe -
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000e00000001c45c-4.dat upx behavioral2/memory/3492-1103-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-1104-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-1755-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-2911-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-2912-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-2913-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-2914-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Internet Explorer\ieinstal.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Defender\mpextms.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files\Windows Mail\wabmig.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe jaffacakes118_Virus.Win32.Lamer.fg.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\msinfo32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\pcaui.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\r\BrowserCore.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\UsoClient.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.26100.1591_none_feafa9b0555ef776\agentactivationruntimestarter.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\r\winlogon.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1_none_fc13383492b3e3d6\csvde.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvix64.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_231fe8bbbb362efd\IEExec.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchFilterHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\AddSuggestedFoldersToLibraryDialog.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\r\rrinstaller.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\spaceutil.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPUEX.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_6a91f0bc88e36d4b\Register-CimProvider.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\sdbinst.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\provlaunch.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\AppVDllSurrogate.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1_none_b7f01667e525edde\dcomcnfg.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\SpeechModelDownload.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PING.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_3b8c278ba0146cc8\tzutil.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\dxdiag.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\r\ctfmon.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\PnPUnattend.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- jaffacakes118_Virus.Win32.Lamer.fg.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Virus.Win32.Lamer.fg.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c45c-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Lamer.fg.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Lamer.fg.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3492
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.8MB
- SHA256 2d4b63f03398be4823d5da1b5d1369756e3ba705b37972058cfe79ceaa153e47
- MD5 f16bd9894245c5ffa6ff0ec6ebdaf194
- SHA1 4b4e98cb117ec55a0443b9779840a8a4cc9ca686
- SHA512 44880ef3f65b767f35cb190a316178b4cdbbb3c2503a66b72dd46ec4ad00f6554bd9dcdb806e11e1e14b7377a41f166506bd9003411d8596bc940f8a5481acaf
- SSDEEP 49152:yxOZ/9phJi/ZzD/2zue/ezSC6vUzPvMHjyQ:9F7IhzDOzhezSC6v2XMH9
- TLSH T1FF854A15B5B88333D0B2D0B6C5E66B79FA3274851B3085CB5389D76C2E23AD6C63533A
- MD5 SHA1 SHA512 SSDEEP TLSH