Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/10/2026, 11:05
Behavioral task
behavioral1
Sample
jaffacakes118_Email-Worm.Win32.Mydoom.l.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Email-Worm.Win32.Mydoom.l.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Email-Worm.Win32.Mydoom.l.exe
- Size 21KB
- Sample261016-m69fgahb83
- SHA256 c4943cfcb280147f1bc03d48cc8bfda0a7dc3d551ebdde47fed896e414904e8d
- MD5 12a830029a4188eec8a73be1c9d02bf0
- SHA1 9be3217b13d662ee8a51329587a8e155956bcf28
- SHA512 e1e0e541fb5ad17b961a326f7284d5c7265c4b61216a0103e7d6851196759e1f392698f7376938fc950b30fb274b25991ddafcb511acf55deadd9eb7bd3f7ff1
- SSDEEP 384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUqv:SCIqdH/k1ZVcT194jp4qv
- TLSH T1C4A2B08777AAD4C5C25441760D53BD7034AA7F3469FC822B3F50BBAFF638A581D04216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects MyDoom family 22 IoCs
resource yara_rule behavioral2/memory/4660-5-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-7-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-8-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-10-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-11-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-12-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-35-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-36-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-37-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-57-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-58-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-74-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-75-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-76-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-78-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-79-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-80-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-82-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-98-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-109-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/4660-111-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom behavioral2/memory/3320-112-0x0000000000800000-0x000000000080D000-memory.dmp family_mydoom - Executes dropped EXE 1 IoCs
pid Process 3320 lsass.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" jaffacakes118_Email-Worm.Win32.Mydoom.l.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe" lsass.exe -
resource yara_rule behavioral2/memory/4660-0-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/files/0x000a000000019cb3-2.dat upx behavioral2/memory/4660-5-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-7-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-8-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-10-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-11-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-12-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/files/0x000c00000001c702-20.dat upx behavioral2/memory/3320-35-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-36-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-37-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-57-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-58-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-74-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-75-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-76-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-78-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-79-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-80-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-82-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-98-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-109-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/4660-111-0x0000000000800000-0x000000000080D000-memory.dmp upx behavioral2/memory/3320-112-0x0000000000800000-0x000000000080D000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\qps-plocm\index.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\Harry Potter.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\index.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\af-ZA\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\Kazaa Lite.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\uz-Latn-UZ\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\ICQ 4 Lite.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\ICQ 4 Lite.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\kk-KZ\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\ml-IN\Winamp 5.0 (en).exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\Harry Potter.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\Winamp 5.0 (en) Crack.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\Winamp 5.0 (en) Crack.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\bn-IN\Kazaa Lite.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\Kazaa Lite.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\Winamp 5.0 (en) Crack.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\Harry Potter.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\Winamp 5.0 (en) Crack.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\index.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\index.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\13ACC0CC-3651-40DE-8E07-A013018D37DA\root\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\13ACC0CC-3651-40DE-8E07-A013018D37DA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\WinRAR.v.3.2.and.key.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\index.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\index.ShareReactor.com lsass.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\ICQ 4 Lite.ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\index.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\Winamp 5.0 (en).com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Cyrl-BA\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\vi-VN\WinRAR.v.3.2.and.key.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\Kazaa Lite.com lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\13ACC0CC-3651-40DE-8E07-A013018D37DA\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\WinRAR.v.3.2.and.key.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\Kazaa Lite.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\Kazaa Lite.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\ICQ 4 Lite.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\WinRAR.v.3.2.and.key.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\Winamp 5.0 (en) Crack.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\Kazaa Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\ICQ 4 Lite.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\qps-ploc\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Harry Potter.ShareReactor.com lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Cultures\Kazaa Lite.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SUMIPNTG\Kazaa Lite.exe lsass.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\Winamp 5.0 (en).exe lsass.exe File created C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\13ACC0CC-3651-40DE-8E07-A013018D37DA\WinRAR.v.3.2.and.key.exe lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\az-Latn-AZ\ICQ 4 Lite.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\lb-LU\Winamp 5.0 (en).exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\Kazaa Lite.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\ICQ 4 Lite.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Winamp 5.0 (en).ShareReactor.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\gd-GB\Harry Potter.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\ICQ 4 Lite.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\Harry Potter.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\Kazaa Lite.com lsass.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Kazaa Lite.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ja\WinRAR.v.3.2.and.key.com lsass.exe File created C:\Program Files\Common Files\microsoft shared\VGX\Winamp 5.0 (en) Crack.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\index.ShareReactor.com jaffacakes118_Email-Worm.Win32.Mydoom.l.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lsass.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File created C:\Windows\lsass.exe jaffacakes118_Email-Worm.Win32.Mydoom.l.exe File opened for modification C:\Windows\lsass.exe lsass.exe File created C:\Windows\lsass.exe lsass.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_Email-Worm.Win32.Mydoom.l.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_Email-Worm.Win32.Mydoom.l.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lsass.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lsass.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Email-Worm.Win32.Mydoom.l.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lsass.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Email-Worm.Win32.Mydoom.l.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Email-Worm.Win32.Mydoom.l.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4660
-
C:\Windows\lsass.exeC:\Windows\lsass.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpFA85.tmp
- Size 21KB
- SHA256 b7df30fc4a1cc1632053622dcadaaa20392a648870b52ad131bffbdc6fac70ef
- MD5 203bae40813ef4a4bb2d089bf9734a99
- SHA1 84e44febf447301291219d65640dac757aa64ea7
- SHA512 cac2658dadb1e300c86e6a55ed9f612f07096aae495f04efc038e5d99401dfc2b139b5490fd65ae8e9b48deea248d56febfa1c8e0c1b62a561da2767a3f47781
- SSDEEP 384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUSe:SCIqdH/k1ZVcT194jp4Se
- TLSH T1D9A2C08777AAD4C5C25441760D93BD7034AA7F3469FC822B3E50BBAFF638A581D04216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\v0Ru.txt
- Size 1KB
- SHA256 5bcd515055ebba049e2727070a93e61b5cc69c8bcc4bcd4594d900193d37b725
- MD5 84766d6fc3c3fe7dbb8424b80ebeedc9
- SHA1 31d7c280a9616722e78dc89a24311eafce0c6398
- SHA512 cab187f77da40d0a57b63c0c48f5aa17356af8e43dcf71c79981ee2402202954af38b28e764969158b7865521ec3c0f6c5f53930f209d12879663a516b8c1f38
- TLSH T12011B7A8FC9279DE548812F1CFEBF1861656BC0D04E00C5F0404214D201A8FC8773D3D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\lsass.exe
- Size 21KB
- SHA256 c4943cfcb280147f1bc03d48cc8bfda0a7dc3d551ebdde47fed896e414904e8d
- MD5 12a830029a4188eec8a73be1c9d02bf0
- SHA1 9be3217b13d662ee8a51329587a8e155956bcf28
- SHA512 e1e0e541fb5ad17b961a326f7284d5c7265c4b61216a0103e7d6851196759e1f392698f7376938fc950b30fb274b25991ddafcb511acf55deadd9eb7bd3f7ff1
- SSDEEP 384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUqv:SCIqdH/k1ZVcT194jp4qv
- TLSH T1C4A2B08777AAD4C5C25441760D53BD7034AA7F3469FC822B3F50BBAFF638A581D04216
- MD5 SHA1 SHA512 SSDEEP TLSH