Overview

overview

7

Static

static

3

jaffacakes...er.exe

windows10-2004-x64

7

jaffacakes...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 03:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_exeblocker.exe
  • Size 2.3MB
  • Sample260910-dpk7wadr7z
  • SHA256 078395bc6ea78086ca6a80d45fcfe7f031a7e9d3c8c58931c502c4b0ce30ab73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwareaspackv2discoverypersistencespywareupx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_exeblocker.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_exeblocker.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a-vumi2n.cmdline"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5764
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB1C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAB1B.tmp"
          4⤵
            PID:860
        • C:\Users\Admin\AppData\Roaming\ctfmon.exe
          C:\Users\Admin\AppData\Roaming\ctfmon.exe
          3⤵
          • Executes dropped EXE
          PID:2736
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\setup.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:2404
    • C:\Windows\system32\ctfmon.exe
      /QuitInfo:000000000000026C;0000000000000270;
      1⤵
      • Checks SCSI registry key(s)
      PID:2128

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Blues.wav
          • Path C:\Program Files (x86)\EXE-Blocker\Blues.wav
          • Size 29KB
          • SHA256 88b2960d1e581d4736025d5184178751015116efaad9e48b1b918b88d4706491
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXE-Blocker.chm
          • Path C:\Program Files (x86)\EXE-Blocker\EXE-Blocker.chm
          • Size 418KB
          • SHA256 270aaf990669524e244b8133fbcfc6dddf62cc8d4460ea3bdf5001c732dac160
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXE-Blocker.exe
          • Path C:\Program Files (x86)\EXE-Blocker\EXE-Blocker.exe
          • Size 356KB
          • SHA256 e95bdf941081a633eab7b943ab38d9bc87654525e10be6858a7855b8410d36cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FILE_ID.DIZ
          • Path C:\Program Files (x86)\EXE-Blocker\FILE_ID.DIZ
          • Size 92B
          • SHA256 b6c5792d7427e0f1d52d602b83b9d5c6b34aa5782073ce72e9a58e89d82d362c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Passwort.log
          • Path C:\Program Files (x86)\EXE-Blocker\Passwort.log
          • Size 10B
          • SHA256 ca65fd039556c6a869868201fabcbd07048ed382f776d73217af8131a699b306
          • MD5 SHA1 SHA512
          Submit Download

          TipOfDay.ini
          • Path C:\Program Files (x86)\EXE-Blocker\TipOfDay.ini
          • Size 672B
          • SHA256 1723cf9ea50850e4c06487579099139864a987fd995bd8c99841b9b64d359afc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          readme.txt
          • Path C:\Program Files (x86)\EXE-Blocker\readme.txt
          • Size 3KB
          • SHA256 ff33f323c0108114d7a340616d98b7fdcbff26382c9a2e6105d4b4d5b403023b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
          • Size 532KB
          • SHA256 d6e7a903c94ddee56f5ea144d3c2cccac2915b342cacf9e6d87794c29ef2433d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
          • Size 3.1MB
          • SHA256 e7e1f6cf17dbf4c451a16e48259317f5041135643e85b3999c37c174613bcb4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          RESAB1C.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\RESAB1C.tmp
          • Size 1KB
          • SHA256 01c07202e827c80ea4c00252a5da5703ac7c521b3c96a6fb8cb2275dc04e9958
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          oggisoft.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\oggisoft.bmp
          • Size 144KB
          • SHA256 8cc7ad512c5a779428f66c05014b809364efcbd0d69e0fb2de5dfe11d9359525
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.cab
          • Path C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\setup.cab
          • Size 2.6MB
          • SHA256 ec2f58006f8f875bc876f20c4638e65b7a0cf02ad5d0fa6cab66faa5204cc057
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.cfg
          • Path C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\setup.cfg
          • Size 51KB
          • SHA256 fabd316312e714b938d358039d5594f6ad15e09ff6a159ae5645b5a37146f831
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_ZupSfx0\setup.exe
          • Size 411KB
          • SHA256 c29a37b70bd40bb1d1131e4f2b9c6e35c0a0f2a9169bbcc8e9112a8ef9a6ff4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a-vumi2n.dll
          • Path C:\Users\Admin\AppData\Local\Temp\a-vumi2n.dll
          • Size 5KB
          • SHA256 d0559516121b2f37550226ba1cf7b22d2991ee46de6a21ca7437fae464ce40b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Backup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\setup~1\Backup.exe
          • Size 76KB
          • SHA256 4d57843d9d0fc142ffaf09c6aa0c9b6a2879233b158621b8af3257f8c804d7d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.zmr
          • Path C:\Users\Admin\AppData\Local\Temp\setup~1\setup.zmr
          • Size 50KB
          • SHA256 5c0bdb3907f14c6c8c0ac52513fd4d46a09cd6ef960e51e0a5d2c4955f183d69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ctfmon.exe
          • Path C:\Users\Admin\AppData\Roaming\ctfmon.exe
          • Size 16KB
          • SHA256 2d61cc6bada564df6e9431a90d2f6d6467927c3ff8ea2d84b2fcc239c4e891e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ComDlg32.OCX
          • Path C:\Windows\SysWOW64\ComDlg32.OCX
          • Size 152KB
          • SHA256 00b5af20504fa3440ef3f9670a49963622d1a3557090e349f465746213761cef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mscomctl.OCX
          • Path C:\Windows\SysWOW64\mscomctl.OCX
          • Size 1.0MB
          • SHA256 e0ab15288662b91d8fa4a5f77d8d72c08a55b0c88324c1cd1441265818aa0c61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sevCmd3.ocx
          • Path C:\Windows\SysWOW64\sevCmd3.ocx
          • Size 138KB
          • SHA256 b71d130c2983a3fb16e3afec0f00595f3d2c148e758c58c956f20ce32e046b98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sevEin20.ocx
          • Path C:\Windows\SysWOW64\sevEin20.ocx
          • Size 287KB
          • SHA256 4d62bd65ea013508127cec704e84c5d3ddf910d365eb37ab91b827b189e8f876
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sevImLib.dll
          • Path C:\Windows\SysWOW64\sevImLib.dll
          • Size 186KB
          • SHA256 55ba4e27cfb010504cf471f9b317c3ab2bb35e8e2170459846757bd530441e96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CSCAB1B.tmp
          • Path \??\c:\Users\Admin\AppData\Local\Temp\CSCAB1B.tmp
          • Size 652B
          • SHA256 a3c79f4cae5ee21cc27d3f63d7b1e6124f01cfd02e81e1d50de429f9cd630045
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          a-vumi2n.0.cs
          • Path \??\c:\Users\Admin\AppData\Local\Temp\a-vumi2n.0.cs
          • Size 4KB
          • SHA256 ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          a-vumi2n.cmdline
          • Path \??\c:\Users\Admin\AppData\Local\Temp\a-vumi2n.cmdline
          • Size 206B
          • SHA256 c77014b430a208791dd32b5ce1d39f31de03a5c13d88a9c371971e18a7248241
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1968-9-0x0000000074932000-0x0000000074934000-memory.dmp
          Download

          memory/1968-8-0x0000000001910000-0x0000000001920000-memory.dmp
          Download

          memory/1968-11-0x0000000001910000-0x0000000001920000-memory.dmp
          Download

          memory/1968-12-0x0000000074932000-0x0000000074934000-memory.dmp
          Download

          memory/2404-363-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-360-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-245-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-366-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-247-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-365-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-246-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-358-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-338-0x0000000034780000-0x00000000347F4000-memory.dmp
          Download

          memory/2404-345-0x0000000011000000-0x00000000110BD000-memory.dmp
          Download

          memory/2404-349-0x0000000031940000-0x0000000031A42000-memory.dmp
          Download

          memory/2404-364-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-359-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2404-362-0x0000000000400000-0x0000000000532000-memory.dmp
          Download

          memory/2736-33-0x0000000000400000-0x0000000000419000-memory.dmp
          Download

          memory/3524-37-0x0000000000400000-0x0000000000414000-memory.dmp
          Download

          memory/3524-56-0x0000000000400000-0x0000000000414000-memory.dmp
          Download

          memory/5764-20-0x0000000074930000-0x0000000074F51000-memory.dmp
          Download

          memory/5764-25-0x0000000074930000-0x0000000074F51000-memory.dmp
          Download