a945b21427a57bf7e5fe4b2b357d562b33035198d6d567a0f6fd2ab6e900de39

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_TTC Video Myth in Human History.exe
Size 5.8MB
Sample260910-erc5qaxbqe
SHA256 a945b21427a57bf7e5fe4b2b357d562b33035198d6d567a0f6fd2ab6e900de39
MD5 50cdb9bfdaaaedf012587c38056f961c
SHA1 95fb81cad749e0b74cb6a98542ceeb6d26c8cf90
SHA512 4da95658ca5c89a5b8630c1c0f7eecc14b5eab539fe67aaafa32c1cdb1f4ef64f35c6438e5bfd3afe0a711ad42343bb978b3b5a32a2c0b369ae9602bf20f87a4
SSDEEP 98304:xGbxlTcCyECaPME5H8Oa4rwKeiQD/drmz6bjT6pQXMCmiJHsrNWuvf6REEQhA3ZM:xslTcCywb5+bYGm6r6pQXMCmiJH4W0fk
TLSH
T13E5633702FB59594C94E34B09F1B0B8459CF0E723AABD309A965F3D011FA3E9BB142D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\lSdFpdUjEJBa.exe"	lSdFpdUjEJBa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\lSdFpdUjEJBa.exe"	file.exe

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_TTC Video Myth in Human History.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SystemDriver.exe

Adds policy Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	lSdFpdUjEJBa.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118_TTC Video Myth in Human History.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Roaming\\SystemDriver.exe"	jaffacakes118_TTC Video Myth in Human History.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Roaming\\SystemDriver.exe"	SystemDriver.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83313942-b21e-454e-b5ae-d01992a63ad5}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	lSdFpdUjEJBa.exe

Executes dropped EXE 6 IoCs

pid	Process
5564	file.exe
5884	file.exe
2676	SystemDriver.exe
4432	file.exe
2620	file.exe
4636	lSdFpdUjEJBa.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SystemDriver.exe"	SystemDriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	lSdFpdUjEJBa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SystemDriver.exe"	jaffacakes118_TTC Video Myth in Human History.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SystemDriver.exe"	jaffacakes118_TTC Video Myth in Human History.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SystemDriver.exe"	SystemDriver.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	file.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Audio HD Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lSdFpdUjEJBa.exe"	lSdFpdUjEJBa.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaffacakes118_TTC Video Myth in Human History.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_TTC Video Myth in Human History.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemDriver.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SystemDriver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lSdFpdUjEJBa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_TTC Video Myth in Human History.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	file.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	lSdFpdUjEJBa.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	file.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	lSdFpdUjEJBa.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	jaffacakes118_TTC Video Myth in Human History.exe
Token: SeDebugPrivilege	2676	SystemDriver.exe
Token: SeDebugPrivilege	5564	file.exe
Token: SeDebugPrivilege	4432	file.exe
Token: SeDebugPrivilege	2620	file.exe
Token: SeDebugPrivilege	4636	lSdFpdUjEJBa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 5564	3084	jaffacakes118_TTC Video Myth in Human History.exe	89
PID 3084 wrote to memory of 5884	3084	jaffacakes118_TTC Video Myth in Human History.exe	90
PID 2676 wrote to memory of 4432	2676	SystemDriver.exe	94
PID 2676 wrote to memory of 2620	2676	SystemDriver.exe	95

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jaffacakes118_TTC Video Myth in Human History.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SystemDriver.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_TTC Video Myth in Human History.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_TTC Video Myth in Human History.exe"
1⤵
- UAC bypass
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3084
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:5884

C:\Users\Admin\AppData\Local\Temp\SystemDriver.exe
C:\Users\Admin\AppData\Local\Temp\SystemDriver.exe
1⤵
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2676
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2620

C:\Users\Admin\AppData\Local\Temp\lSdFpdUjEJBa.exe
C:\Users\Admin\AppData\Local\Temp\lSdFpdUjEJBa.exe
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemDriver.exe

Path C:\Users\Admin\AppData\Local\Temp\SystemDriver.exe
Size 5.8MB
SHA256 a945b21427a57bf7e5fe4b2b357d562b33035198d6d567a0f6fd2ab6e900de39
MD5 50cdb9bfdaaaedf012587c38056f961c
SHA1 95fb81cad749e0b74cb6a98542ceeb6d26c8cf90
SHA512 4da95658ca5c89a5b8630c1c0f7eecc14b5eab539fe67aaafa32c1cdb1f4ef64f35c6438e5bfd3afe0a711ad42343bb978b3b5a32a2c0b369ae9602bf20f87a4
SSDEEP 98304:xGbxlTcCyECaPME5H8Oa4rwKeiQD/drmz6bjT6pQXMCmiJHsrNWuvf6REEQhA3ZM:xslTcCywb5+bYGm6r6pQXMCmiJH4W0fk
TLSH
T13E5633702FB59594C94E34B09F1B0B8459CF0E723AABD309A965F3D011FA3E9BB142D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file.exe

Path C:\Users\Admin\AppData\Local\Temp\file.exe
Size 80KB
SHA256 baad363b9a8e661a00d58af16b84b1ec515c73ce4012162e206effaa5351fca5
MD5 5c6e16801e199006f06d1300a31c4d69
SHA1 5972ca9a8ede8705db9d93f72c498f23826948b9
SHA512 06f5da46962c3723b1c9e56c63281e32d61559a795584c52d333aae0f799b87ec44141c3b933543ee1ffeb0fca218be39157ea4ac868f4543b7f598e8ffdeeef
SSDEEP 1536:nHFlZvBVWRRBc3tCt8K5RfnDqbjJ7VseTVylwNVF5J8Wgx5Tnnnnn1o3q9:xfWbBc3JiVIF7VJs8H5J8bq3o
TLSH
T1B8830808B7B16612C39D157141E2BA581370EE4BF582FB5A7C8D32EF029AFC66D071DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2676-23-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/2676-26-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/3084-0-0x0000000001C20000-0x0000000001C30000-memory.dmp

Download

memory/3084-1-0x0000000074FA2000-0x0000000074FA4000-memory.dmp

Download

memory/5564-16-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/5564-17-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/5564-34-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/5884-20-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/5884-19-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

memory/5884-31-0x0000000074FA0000-0x00000000755C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads