0fcbe5c63707417420a68c6d3626ec9e868b79b0ffac490154ab1feb1bc8cffa

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_keygen.exe
Size 462KB
Sample260910-dpnb8sdr71
SHA256 0fcbe5c63707417420a68c6d3626ec9e868b79b0ffac490154ab1feb1bc8cffa
MD5 e89ae52e2610283abbb400dc62bd1c6f
SHA1 870367a16281c8e66dc42e6740cf052bedd72097
SHA512 60f5301349848e5a29f8b8a3717527fe297621eeda016d3477896af11dbfe3bb62310a56a5ea9e87ee1da983af5f6aa17a1434f3737bd8cfd48879bd38a08e75
SSDEEP 12288:RJqTuw/pAd1kDv4HaeNBhD2es49WaQBMhYmC40:RHwRWOj46eHt2es49Wa/hYm
TLSH
T1E5A402629BD4807BE0D0637149EA31A31778FCA16F38A3EFA38059CA99716C4657C35F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3344	1.exe
980	ctfmon.exe
4344	setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_keygen.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3344 set thread context of 980	3344	1.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3344	1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
980	ctfmon.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3344	3280	jaffacakes118_keygen.exe	87
PID 3344 wrote to memory of 2376	3344	1.exe	89
PID 2376 wrote to memory of 4880	2376	csc.exe	91
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3344 wrote to memory of 980	3344	1.exe	92
PID 3280 wrote to memory of 4344	3280	jaffacakes118_keygen.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_keygen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_keygen.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\abbl19tw.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C62.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6C61.tmp"
      4⤵
      PID:4880
- - C:\Users\Admin\AppData\Roaming\ctfmon.exe
    C:\Users\Admin\AppData\Roaming\ctfmon.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:980
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  2⤵
  - Executes dropped EXE
  PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
Size 532KB
SHA256 d6e7a903c94ddee56f5ea144d3c2cccac2915b342cacf9e6d87794c29ef2433d
MD5 1f6c1c73423b2d9af344a531006f5bcd
SHA1 806d7a507b775abc34fdc02726c0c16aba8802c2
SHA512 7e37473f846fb98704340a1b21b5b0e94c5fdd537c87c3c8550456b9b0369e6f612133b59ac29834e82b2d924cacb38377446f7cda5e20e91d20b045e1833cb1
SSDEEP 12288:6EZw4AWTXUF1pOXbiQ6dbXh9tU1gSeHbvqhn7rXKNuJasxIuPGSv1JB00qb:vjUFCeBuAbAJaevR
TLSH
T14EC4D05026DCB71CFBB71AF98DEDB7E746AA2E912643D48EB30C53520701764EF00969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
Size 19KB
SHA256 dc7c9b1ec96781926fc3538fc93797230bc2194fbdd379a77a862ff1174a9a59
MD5 008bfb6725d594d4827c9e09a4835534
SHA1 eed1af840075ac78e8703d3f554be70cba6e2506
SHA512 3ce34258a72cc8099b693fffcf9d19032cd156bd90ce12a225f701fd05c2f97219dcf9e1e15a66ea70b3038c5b827279cc0866a7851b0e4d0ddc93d119292284
SSDEEP 384:45lAargzqj5TZYPlVedmY+WrgV8U62igloLewvKr59OBbA2/kkE:45lAaUWnQWsNiEgXCr59qbWV
TLSH
T14A92CF731294C81EF403AA345193DB583A72EEF8834E4BC2759A7A73ED7A6900F41D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES6C62.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C62.tmp
Size 1KB
SHA256 d98c6ec88a00d571dc92d6be885b1a39c718336febcc5b208cd02895c0855894
MD5 848952a0750f820df5692b6de82ad684
SHA1 c4fc729c6abd8a4644e29c2ff7410d9e53fc7868
SHA512 c77c50bd7fb2ba459aecbf0e41a5113c6ef694356809601d48ad9a083ea2020e1c2fcdc16b1de5159de23580a97d0f67d5f3c5e474fcede43afa7922e48af28e
TLSH
T1C521590553E8470AF0B74731B9F6536BA238FD64DFA2A39B8480022C2C52954EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

abbl19tw.dll

Path C:\Users\Admin\AppData\Local\Temp\abbl19tw.dll
Size 5KB
SHA256 fd12a09989615b0d232584f5c8e128dcb8222d0a7caeef88ee74c9074efdf64b
MD5 888eb4b4983452125afaf228a05050f3
SHA1 1d5eb5b7387cab63feac78d50c59f9894a78114b
SHA512 fc415194c929a2c988f069d96034b10a08cb619e99481a904207dbe3838a1c70890876893166423b32550c8bea99f75f3fe3eb5f5d773703b68261d2e06c6e13
SSDEEP 48:6l0bPqA2+aKcL77X7S7MLSOlVfiwKHOg5fHYZGJYBjTDyni1ebU9gl86Y41ulyaj:vPqARpwKugSzL3EK
TLSH
T15AB1761647DC8667E4AE073AF5E3076363B5D0219BF3472F0990417D9CB63A007267E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctfmon.exe

Path C:\Users\Admin\AppData\Roaming\ctfmon.exe
Size 16KB
SHA256 2d61cc6bada564df6e9431a90d2f6d6467927c3ff8ea2d84b2fcc239c4e891e3
MD5 8f1dde163f91588a7ec13f678abdb25c
SHA1 67d182cd9e414b71f472ccf4bc6fe23946be9821
SHA512 d33db9693d03aba2ade7b6d976184f6ae0429e95f51221aa06e208f9682a62cf2227d42a713037bd8bfeff5582ff7c18da5f0d9de604a70e8cadf24ec80aa01c
SSDEEP 48:yOlx2BcRQZH9+7Ho+2/LUD18nf4MQXTZ7tdXAsb3zP+IbkAu9NC8Otc0U3wq6RU2:/lximQZKO/sigZDfDWIbf6NXPPY02
TLSH
T1EB724152F66DE872F46943720E73CBEA4016BC700E258E1F3C943F5F2C302A06E91A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC6C61.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC6C61.tmp
Size 652B
SHA256 d6e9e59e14b5b73480850bddf99d83bbca7088cb7efdb04d9924c643439ae221
MD5 221391b0d9332f61b61fd17415a69cdb
SHA1 a48ce8c7fc65a2c3c858d8a82ed6f3cd5cebca72
SHA512 bb4125bc7a50c02e7a047aede66ea4d575f3e39aed1002570ba673301a855f97afb8a578f881875e79a39378a7c305fca1df861a48883f18805923e6b3045d34
TLSH
T150F0544963F8120EF0F34B30BDF543A39169BC64EE7293ED1440131D18645209661F72
MD5 SHA1 SHA512 TLSH

Submit Download

abbl19tw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\abbl19tw.0.cs
Size 4KB
SHA256 ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8
MD5 6830431c6b49f72eaca4b2888a0ddaa9
SHA1 502083f68f991bfcfd771a7ba5bd508c2834591c
SHA512 939fa8cb2ca518904dea91b9612c53d833b9cf11e393fb376c1b0d00734e52b33708a6302e04bf15cb6a8e745475163766dec5a29ac265c914d0c286a170b35a
SSDEEP 48:J1o3rRWEmVrLyNrRh5orROzRKuoEXLrI5L77sUdN/0RMoOcJcrCHGYBa2oU2fTmH:J1oS5yXwLj2hHrCgW92
TLSH
T1FAA120180E24970412F6221EEECA835DFA5750372FFE6A25B47C50311FBA1A8D37AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abbl19tw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\abbl19tw.cmdline
Size 206B
SHA256 2e6a1ba5c46656f0b5137c240e41719041d6ec8e504cf4f9afac948ffed4e599
MD5 f6ecb64997296b266954767b829460f2
SHA1 20d92527af08ca83dc249d470a685894e780d23b
SHA512 fd21dbcaa0026be15b4292b18ce40b3a6500aee601f5551663b34580c5681b2047cb9d9463a8e8a5821f74258438ac5e1f7bd3a0366f9aa1f10a0547375e1653
TLSH
T1CFD02216038EC72C15E8800BA0E0C1FC82B24E5A2D053FAC9240840C133348CF3F5702
MD5 SHA1 SHA512 TLSH

Submit Download

memory/980-42-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-43-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-25-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-33-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-36-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-44-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-41-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-40-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-39-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/980-38-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2376-17-0x00000000745D0000-0x0000000074B81000-memory.dmp

Download

memory/2376-22-0x00000000745D0000-0x0000000074B81000-memory.dmp

Download

memory/3344-8-0x00000000745D2000-0x00000000745D4000-memory.dmp

Download

memory/3344-7-0x00000000013B0000-0x00000000013C0000-memory.dmp

Download