Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251223-en - resource tags
arch:x64arch:x86image:win10v2004-20251223-enlocale:en-usos:windows10-2004-x64system - submitted
18/12/2025, 23:30
Behavioral task
behavioral1
Sample
JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe
Resource
win10v2004-20251223-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe
0 signatures
150 seconds
General
- Target JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe
- Size 502KB
- Sample251218-3hl82avlgl
- SHA256 a020c13cc0871cf7193e108b0ab9e3a99d88a9c56102aab461a07a7a1459480f
- MD5 3b786f5a3f82f03d3bb25767f6dc40f7
- SHA1 c779c1e957ecc52ded8ac7bc976a9d2bc6e1a962
- SHA512 1ab95843c8f7e86f8c2f0907ea42aa4668173a2f1a7dc71c29701970645d18a39e45f1210256b129e2a02162dee38a9389fc2a8cedc4275f1aa3890e93ab3bf6
- SSDEEP 6144:63OOCKLlcPKJEld2zJQPfuSlMHyaXXu6FQGkcC+V5R5azYBONNYJGxMtFn7y:iOOZpUtlwX+zc7V5Rn1JV7y
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Fasong 13 IoCs
resource yara_rule behavioral1/memory/4564-0-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/4564-2-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/files/0x0008000000024340-11.dat family_fasong behavioral1/memory/736-24-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/files/0x000100000000002a-23.dat family_fasong behavioral1/memory/736-25-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/4564-27-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/736-26-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/3392-30-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/3392-31-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/3392-35-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/2012-34-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong behavioral1/memory/2012-33-0x0000000000400000-0x000000000047E000-memory.dmp family_fasong - Fasong family
- Executes dropped EXE 3 IoCs
pid Process 736 EALTLAK.EXE 3392 PDNS.EXE 2012 EALTLAK.EXE - Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE \"%1\" %*" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EALTLAK.EXE - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PDNS.EXE = "C:\\Program Files\\PDNS.EXE" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe - Enumerates connected drives 3 TTPs 51 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: EALTLAK.EXE File opened (read-only) \??\R: EALTLAK.EXE File opened (read-only) \??\H: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\L: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\N: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\K: EALTLAK.EXE File opened (read-only) \??\M: EALTLAK.EXE File opened (read-only) \??\G: EALTLAK.EXE File opened (read-only) \??\J: EALTLAK.EXE File opened (read-only) \??\U: EALTLAK.EXE File opened (read-only) \??\I: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\U: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\S: EALTLAK.EXE File opened (read-only) \??\V: EALTLAK.EXE File opened (read-only) \??\Q: EALTLAK.EXE File opened (read-only) \??\R: EALTLAK.EXE File opened (read-only) \??\S: EALTLAK.EXE File opened (read-only) \??\R: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\J: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\H: EALTLAK.EXE File opened (read-only) \??\L: EALTLAK.EXE File opened (read-only) \??\T: EALTLAK.EXE File opened (read-only) \??\K: EALTLAK.EXE File opened (read-only) \??\T: EALTLAK.EXE File opened (read-only) \??\E: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\P: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\S: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\V: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\G: EALTLAK.EXE File opened (read-only) \??\M: EALTLAK.EXE File opened (read-only) \??\N: EALTLAK.EXE File opened (read-only) \??\K: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\M: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\O: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\U: EALTLAK.EXE File opened (read-only) \??\I: EALTLAK.EXE File opened (read-only) \??\V: EALTLAK.EXE File opened (read-only) \??\I: EALTLAK.EXE File opened (read-only) \??\O: EALTLAK.EXE File opened (read-only) \??\Q: EALTLAK.EXE File opened (read-only) \??\H: EALTLAK.EXE File opened (read-only) \??\P: EALTLAK.EXE File opened (read-only) \??\Q: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\G: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\T: JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened (read-only) \??\P: EALTLAK.EXE File opened (read-only) \??\E: EALTLAK.EXE File opened (read-only) \??\L: EALTLAK.EXE File opened (read-only) \??\O: EALTLAK.EXE File opened (read-only) \??\E: EALTLAK.EXE File opened (read-only) \??\J: EALTLAK.EXE -
resource yara_rule behavioral1/memory/4564-0-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/4564-2-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/files/0x0008000000024340-11.dat upx behavioral1/memory/736-24-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/files/0x000100000000002a-23.dat upx behavioral1/memory/736-25-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/4564-27-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/736-26-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/3392-30-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/3392-31-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/3392-35-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/2012-34-0x0000000000400000-0x000000000047E000-memory.dmp upx behavioral1/memory/2012-33-0x0000000000400000-0x000000000047E000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\PDNS.EXE JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File opened for modification C:\Program Files\PDNS.EXE JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe File created C:\Program Files\WRYV.EXE EALTLAK.EXE - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EALTLAK.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDNS.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EALTLAK.EXE - Modifies registry class 62 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open EALTLAK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE %1" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell EALTLAK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE \"%1\"" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE %1" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE \"%1\"" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open EALTLAK.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files\\PDNS.EXE \"%1\" %*" JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open EALTLAK.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4564 wrote to memory of 736 4564 JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe 85 PID 3392 wrote to memory of 2012 3392 PDNS.EXE 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b786f5a3f82f03d3bb25767f6dc40f7.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4564 -
F:\$RECYCLE.BIN\EALTLAK.EXEF:\$RECYCLE.BIN\EALTLAK.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:736
-
-
C:\Program Files\PDNS.EXE"C:\Program Files\PDNS.EXE"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
F:\$RECYCLE.BIN\EALTLAK.EXEF:\$RECYCLE.BIN\EALTLAK.EXE2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2012
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\PDNS.EXE
- Size 502KB
- SHA256 29890c78ec016acc991fbf81e44c90cf0d56206e5d0c3d93a8f5b1e1ad8ee728
- MD5 73d2edd25cb6e61b21650cab474208b1
- SHA1 36e0d5efcab50ace608ecff08ff3543589746d97
- SHA512 c0c524944e435133a0a799a9c1237bbb8973bfe20674d4bba6abd61804c6d7526bb535fedbee8b8c6fa55fc88d0f7d0a0b9a2be8c5b735af84c4f869b5619ea4
- SSDEEP 6144:63OOCKLlcPKJEld2zJQPfuSlMHyaXXu6FQGkcC+V5R5azYBONNYJGxMtFn7y:iOOZpUtlwX+zc7V5Rn1JV7y
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\EALTLAK.EXE
- Size 503KB
- SHA256 118506f7a352bdae5c9d65470bb6c675abdd8d87298c896ed283e2a0d92bf2d6
- MD5 2dd35f3a2b809b58773be271815ca75c
- SHA1 7504028e1be0eff539f2a1c95464f765b294da92
- SHA512 225494766b6261605ec30c3707d84c52029d28b0dafbb7d557bec6ae948fb4cf4846a5cba8c9ce84b83bae8cc530d265424de254a66fbf54f1e7f7f592dbba90
- SSDEEP 6144:63OOCKLlcPKJEld2zJQPfuSlMHyaXXu6FQGkcC+V5R5azYBONNYJGxMtFn7y:iOOZpUtlwX+zc7V5Rn1JV7y
- MD5 SHA1 SHA512 SSDEEP