ed6841bd79d045bdb2c94e809f05d076383b3fd9af43ad39e8fb55c2ccf58b2b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_setup_2fkncdiw.exe
Size 1.8MB
Sample260910-cvlj6aef76
SHA256 ed6841bd79d045bdb2c94e809f05d076383b3fd9af43ad39e8fb55c2ccf58b2b
MD5 c48ab433bbec368f7e054da8cd229361
SHA1 c7ab5221b442a669ddf324048873cf4d72f0a851
SHA512 bca271b192b92b208b330c4733fc8b059dd9118d980c8bbef00c85d4a203c41c32827f65854689ed74910161ac328afafe4ada6c12ec8cb873afb0c2b6c20ca4
SSDEEP 49152:6kJzfPQ8YzGwPuhS5O2Cn6G8dhcWKc7BC6Dw1Rs8N:6wI89wPuWOL65dh71Ctx
TLSH
T12F8533F392A5C0DBC91C16396034BA4249FE58AD8C68F3BDE5408FBCFB556A324702E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5124	Result.scr
5748	Result.scr
1144	cardrecovery_setup.exe
956	cardrecovery_setup.tmp

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	jaffacakes118_setup_2fkncdiw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5124 set thread context of 5748	5124	Result.scr	89

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4504-0-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4504-2-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4504-3-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4504-30-0x0000000000400000-0x0000000000590000-memory.dmp	upx
behavioral2/memory/4504-37-0x0000000000400000-0x0000000000590000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_setup_2fkncdiw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Result.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cardrecovery_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cardrecovery_setup.tmp

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000d00000001c5b9-28.dat	innosetup
behavioral2/memory/1144-36-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/1144-34-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/1144-49-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4504	jaffacakes118_setup_2fkncdiw.exe
4504	jaffacakes118_setup_2fkncdiw.exe
4504	jaffacakes118_setup_2fkncdiw.exe
4504	jaffacakes118_setup_2fkncdiw.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5124	Result.scr

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4504	jaffacakes118_setup_2fkncdiw.exe
4504	jaffacakes118_setup_2fkncdiw.exe
5124	Result.scr

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 5124	4504	jaffacakes118_setup_2fkncdiw.exe	88
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 5124 wrote to memory of 5748	5124	Result.scr	89
PID 4504 wrote to memory of 1144	4504	jaffacakes118_setup_2fkncdiw.exe	90
PID 1144 wrote to memory of 956	1144	cardrecovery_setup.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_setup_2fkncdiw.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_setup_2fkncdiw.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\Result.scr
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\Result.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Users\Admin\AppData\Local\Temp\MMBPlayer\Result.scr
    "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\Result.scr" c:\users\admin\appdata\local\temp\Program.exe
    3⤵
    - Executes dropped EXE
    PID:5748
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\cardrecovery_setup.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\cardrecovery_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\is-R5HGU.tmp\cardrecovery_setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-R5HGU.tmp\cardrecovery_setup.tmp" /SL5="$80260,573231,53248,C:\Users\Admin\AppData\Local\Temp\MMBPlayer\cardrecovery_setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Result.scr

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\Result.scr
Size 977KB
SHA256 5aba0f0f544cd43ead28835e3b5782b0546a49e46f3988202edd467c1d07ce8c
MD5 88216637113def256d6aac1a69f227b4
SHA1 a366cdb2a6ee2fc8cdeb8bcc64c9a702b9308331
SHA512 beb8e2e487354eb11e43a3bc17b77603c14cec9a933d3a2bc6fdcd37b2f62a376c358ef09d38d299ca3a1811ab8d6662305747d1e07fcd5eb8d46f52da22540d
SSDEEP 24576:HKMWXFO4glSrKB0N1iGd616AWmQKmjtzpSqy4HejrvzutKhDzbZuB:8O4glSBTjt1Si9tKhDzbZuB
TLSH
T1FC258D2AB2E08233D03346789D5A92A5A82DFD313E286C1FF7D15F0C5A7A9837525397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cardrecovery_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\cardrecovery_setup.exe
Size 816KB
SHA256 7609118eee7212d1640bbb04c88785d5d07543b84d1617dae6495d325b1e93c3
MD5 6fe2207aab56976e44b5c71ee52b1299
SHA1 15578953ea1d9ea86f33c1ac46fba5a512f8d2db
SHA512 89b537824cfebcf2390b2202d031e973914de092ce06702b3ab7ffec84d3deb2cd0b322a3f7c70e30c4acfcb4286cbb0972b8b4f44a5aff9897ede47e7c1a6dc
SSDEEP 24576:92UeWDcQXgoCVhU8NIW60ivI5OfN+8YaXaA:92Jv0gokh3Sg5OfN0ap
TLSH
T1C80523F7819186FAD0108F709C3AF25589BB3D691C34A864354C8EE8BF6F7927849397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cardrecovery_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-R5HGU.tmp\cardrecovery_setup.tmp
Size 669KB
SHA256 25fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
MD5 52950ac9e2b481453082f096120e355a
SHA1 159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA512 5b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
SSDEEP 12288:L/vksLWtSNrPi37NzHDA6Y1gbl5d7Ifoz4mrNNpRpzqjxy:jvksLWtkrPi37NzHDA6Yg5dsfoTzsxy
TLSH
T1ACE46B32F2A09837D1B32F789D1B86955936BE103E38A59736E81F0C4F7968179273D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

test.htm

Path C:\Users\Admin\AppData\Local\Temp\test.htm
Size 3B
SHA256 fa690b82061edfd2852629aeba8a8977b57e40fcb77d1a7a28b26cba62591204
MD5 6057f13c496ecf7fd777ceb9e79ae285
SHA1 7f550a9f4c44173a37664d938f1355f0f92a47a7
SHA512 0601d109d0d2b0fa9c4484b4a5c94ee5ecc62ccec3bd7d99e972d18994d0e2e42f6d0fcfc41216a5ab72ee7af96d213e1c314abdde40f52731ff24c2bf8f7323
MD5 SHA1 SHA512

Submit Download

memory/956-59-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-63-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-73-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-71-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-69-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-67-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-65-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-61-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-57-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-55-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-51-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/956-53-0x0000000000400000-0x00000000004B6000-memory.dmp

Download

memory/1144-49-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1144-34-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1144-36-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4504-1-0x000000000058F000-0x0000000000590000-memory.dmp

Download

memory/4504-0-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4504-37-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4504-3-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4504-30-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/4504-2-0x0000000000400000-0x0000000000590000-memory.dmp

Download

memory/5748-21-0x0000000000400000-0x0000000000426000-memory.dmp

Download