c56f8288415867a4eee3a583c6359a29fa2e2af9af75286054ec48fc9655a09d

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_setup_82h9brv4.exe
Size 4.0MB
Sample260910-ct3r2sef68
SHA256 c56f8288415867a4eee3a583c6359a29fa2e2af9af75286054ec48fc9655a09d
MD5 fea74d6a6cd91e243ff04523b01bafb4
SHA1 33bc121109141af7a8207335dedbc12b6486bdec
SHA512 3ff9ca7188d0643b33112ae4c1dd313d4d9a2b6b73b627419716b098491fdc30fb6e79dd3a8751de10a7c996e5a243f03c5ae7c0772150eef5d896e91f9cc664
SSDEEP 98304:XzeI8sh7aciOIpWcCQ3mqtYMgxEazB4LdV1QsQ4+tfn2tqj:XiNsh7K3Uvqt2P14LztO2tqj
TLSH
T191163354BAABCA7DEA19623C0F04D809B76451EE0173FFB953EEAA5C2C610107E7C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3756	5.6-Spread.exe
2256	AliveDVDRipper.exe
420	is-UDL0B.tmp
3360	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Program Files (x86)\\Internet Explorer\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Program Files (x86)\\Internet Explorer\\svchost.exe\""	5.6-Spread.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	jaffacakes118_setup_82h9brv4.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1256-0-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1256-2-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1256-3-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/1256-26-0x0000000000400000-0x0000000000596000-memory.dmp	upx

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\svchost.exe	5.6-Spread.exe
File created	C:\Program Files (x86)\Internet Explorer\iesettings.ceb	iexplore.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iesettings.ceb	iexplore.exe
File created	C:\Program Files (x86)\Internet Explorer\svchost.exe	5.6-Spread.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AliveDVDRipper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_setup_82h9brv4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.6-Spread.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-UDL0B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1256	jaffacakes118_setup_82h9brv4.exe
1256	jaffacakes118_setup_82h9brv4.exe
1256	jaffacakes118_setup_82h9brv4.exe
1256	jaffacakes118_setup_82h9brv4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	jaffacakes118_setup_82h9brv4.exe
1256	jaffacakes118_setup_82h9brv4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 3756	1256	jaffacakes118_setup_82h9brv4.exe	89
PID 1256 wrote to memory of 2256	1256	jaffacakes118_setup_82h9brv4.exe	90
PID 2256 wrote to memory of 420	2256	AliveDVDRipper.exe	91
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92
PID 3756 wrote to memory of 5416	3756	5.6-Spread.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_setup_82h9brv4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_setup_82h9brv4.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\5.6-Spread.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\5.6-Spread.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:5416
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6200
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\AliveDVDRipper.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\AliveDVDRipper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\is-UMACU.tmp\is-UDL0B.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-UMACU.tmp\is-UDL0B.tmp" /SL4 $70240 C:\Users\Admin\AppData\Local\Temp\MMBPlayer\AliveDVDRipper.exe 1514852 51200
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:420

C:\Program Files (x86)\Internet Explorer\svchost.exe
"C:\Program Files (x86)\Internet Explorer\svchost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3360
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Program Files (x86)\Internet Explorer\svchost.exe
Size 3.3MB
SHA256 44bb67b679f30a039f19f58f42e6273e782777f82b2d93b5992072eb2e312561
MD5 9836b5693296dd83dc3d33350e0d00de
SHA1 33d195c8b9828acaca14fbebd91379273ec95b41
SHA512 8f4c79618c286b0c0df43fae6a0c3a78bb768a67cdf9fbf23dc0eee0be68fe81ef7115a60b847b756bdc6f6eb04d734412efdb21d3a44e3423685e7ff15ac11a
SSDEEP 24576:Wc9d8PA2Qe+F20LfWzg6IiY/KhsyMhMNdJwm6eZghdTvznYtUeeFUfKss+GnUT3V:ewb
TLSH
T1D6F5AEFDB62ADCD2DC052AF59C10DAF34B1C76314EA80067395B6F4C4A770EA814EEA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5.6-Spread.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\5.6-Spread.exe
Size 3.3MB
SHA256 11d31bfe5f1b75e074963a233b1435af5ef9f81e27b5a6e50b9580ac04879597
MD5 c1c098458e0b30ce323b61d10a21be86
SHA1 59ee9ecc78c4ff6aebca80a857b6d7d3d622c71e
SHA512 6dd5d0a54b78edf30b083847e1130ce2d6f35d3a61134feb3f205723a07aaef99b234694032bd297be4d13c69928f4668e7ed007cafa9bf92c62d9fe1e277111
SSDEEP 24576:Jc9d8PA2Qe+F20LfWzg6IiY/KhsyMhMNdJwm6eZghdTvznYtUeeFUfKss+GnUT3V:Vwb
TLSH
T111F5AEFDB62ADCD2DC052AF59C10DAF34B1C76314EA80067395B6F4C4A770EA814EEA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AliveDVDRipper.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\AliveDVDRipper.exe
Size 1.7MB
SHA256 ec92d18471e0d3c90246c617841cf90cc5b3acab58b17e341bb3433921f54263
MD5 890233505fd37d9f5770c97bef88c5e4
SHA1 d67595d1b6656ea142ad8f2c6b64dcb3970e1ab3
SHA512 f55fd0bd6df2a4376bac47a624fac459669ba05286e47a0ad55ae6f1e48388fc4538a94ea0f3e419c85992c20917dbc39fcd3af0d11b6e2c3caf61498143a75b
SSDEEP 49152:p9POLi07s5KviEoJUSwuvYpei+n/x3e9v+37Z:p9P+7JVbSwge+np3et4Z
TLSH
T189853365F657C238D531A63C2E18C0A8F774B995053761B8336E1E9C1DA32106F9CFAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-UDL0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-UMACU.tmp\is-UDL0B.tmp
Size 615KB
SHA256 74ef33e3b3298d8ca7166c2b07a490a74c5a9a26b08b9478a524096208d5600a
MD5 667555fc8d80c030ed5de256404df5c5
SHA1 44a4ea8240378905cf40527b0bd9da7ffb22416f
SHA512 88aee726e41cf4e2635deaea68a374a8eda14e82bc65babb566ec60a93fcea823bde67f9d47e69af946b3d1c8c9fb2ea9003fe83b5c401384c64977dfebcc998
SSDEEP 12288:I8jI/G3IacrPw37SzHkYA6mkIoT6NhN/OXExp:k/QIzrPw37SzHkYA6mIGmXExp
TLSH
T13AD45C22F2A0C837D1B32E78AD5786D49826FD102F34A49776E81F4C4F396917A273D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-91-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-79-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-75-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-73-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-93-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-71-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-77-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-69-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-89-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-87-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-85-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-83-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/420-81-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1256-3-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1256-1-0x0000000000595000-0x0000000000596000-memory.dmp

Download

memory/1256-2-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1256-0-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/1256-26-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/2256-27-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2256-68-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2256-24-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3360-59-0x0000000000400000-0x0000000000753000-memory.dmp

Download

memory/3756-67-0x0000000000400000-0x0000000000753000-memory.dmp

Download

memory/3756-60-0x0000000010570000-0x00000000106CB000-memory.dmp

Download

memory/3756-49-0x0000000010570000-0x00000000106CB000-memory.dmp

Download

memory/3756-42-0x0000000010410000-0x000000001056B000-memory.dmp

Download

memory/3756-35-0x0000000010410000-0x000000001056B000-memory.dmp

Download