Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/09/2026, 11:43
Behavioral task
behavioral1
Sample
jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe
- Size 229KB
- Sample260918-nvmb8sthph
- SHA256 df73a89d3fd46d08d049e41e2050c30668515330038afa1597370e54a8d3ce7f
- MD5 f6b8980c942da6e468df284b4b8824f3
- SHA1 911a9f05ad01badc8982f49dbce06934d77d611a
- SHA512 46d96995a9c7e29afa63a5ea51a1c2dc69a563793c2788c582e27dd9b3b1f3e1abe9fe22dddaead8459e2f9092ef10e280ecce4d23f5ad8d73599b9bab4cfd24
- SSDEEP 6144:tS9Sb15YmbdnpHQGHpU0GP+Bu+wLi109CzUZUwW6c5G2p0riWUY41bwrJRxxRYph:tSA/JpfHpzz
- TLSH T12E34DF52B3F89A44F6F33B385D7286A44E76FCA2ED34C65D2264780E2C71A5488B0737
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Fasong 5 IoCs
resource yara_rule behavioral1/memory/4560-2-0x0000000000400000-0x0000000000490000-memory.dmp family_fasong behavioral1/memory/4952-21-0x0000000000400000-0x0000000000490000-memory.dmp family_fasong behavioral1/memory/4560-24-0x0000000000400000-0x0000000000490000-memory.dmp family_fasong behavioral1/memory/4952-26-0x0000000000400000-0x0000000000490000-memory.dmp family_fasong behavioral1/memory/4952-27-0x0000000000400000-0x0000000000490000-memory.dmp family_fasong - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0007000000024329-10.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4952 svchost.exe - Loads dropped DLL 4 IoCs
pid Process 4560 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe 4560 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe 4952 svchost.exe 4952 svchost.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\Q: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\E: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\L: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\O: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\R: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\S: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\T: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\U: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\J: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\M: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\H: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\P: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\V: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\G: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\I: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened (read-only) \??\K: jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\FEXO.dll jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe File opened for modification C:\Windows\SysWOW64\FEXO.dll jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe -
resource yara_rule behavioral1/memory/4560-0-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral1/memory/4560-2-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral1/files/0x0007000000024329-10.dat upx behavioral1/memory/4560-13-0x0000000000760000-0x0000000000780000-memory.dmp upx behavioral1/files/0x0019000000024212-16.dat upx behavioral1/memory/4560-14-0x0000000000760000-0x0000000000780000-memory.dmp upx behavioral1/memory/4952-21-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral1/memory/4560-24-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral1/memory/4952-26-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral1/memory/4952-27-0x0000000000400000-0x0000000000490000-memory.dmp upx - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svchost.exe jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\ = "Webhook1001PV" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WPWorkFilePV svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ = "Webhook1001PV" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ThreadingModel = "Apartment" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ = "Webhook1001PV" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\Clsid jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\Clsid\ = "{A717F661-41D3-11D8-9BD7-962A4BD65539}" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID\ = "FEXO.ExecuteHookWebPV" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WPWorkFilePV\DFile = "053039186053036187099140050033094108136065150122056044111038210074058140033029240160173107184147094097063216154114235107096" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\ = "Webhook1001PV" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\Clsid\ = "{A717F661-41D3-11D8-9BD7-962A4BD65539}" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ = "C:\\Windows\\SysWow64\\FEXO.dll" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\ProgID\ = "FEXO.ExecuteHookWebPV" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WPWorkFilePV\EFile = "053037191053036186107134050033081096020066122166012118083039147052106155115222214095090079084039066032251254225183111199100" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32 svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32\ = "C:\\Windows\\SysWow64\\FEXO.dll" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FEXO.ExecuteHookWebPV\Clsid svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WPWorkFilePV jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539} jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A717F661-41D3-11D8-9BD7-962A4BD65539}\InprocServer32 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4560 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe 4560 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4952 svchost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4952 4560 jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f6b8980c942da6e468df284b4b8824f3.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files\svchost.exe"C:\Program Files\svchost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4952
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\svchost.exe
- Size 230KB
- SHA256 bc7cf0fe34d8c932056cbaa1e540b06f85ddb6c52f37ed93c288cabf12477899
- MD5 6e6f6f1fcec3746e1e38fe6175a934f3
- SHA1 0eec3a2ac698c2305c09a89e821e115001d587ca
- SHA512 66bbb5eb3372112fae38522dca43538e56513a7d3ecb8fbdc308a450056e159649b1f6d0061c6462724469991f10661dbd2b1c66618991069c67237635202b09
- SSDEEP 6144:tS9Sb15YmbdnpHQGHpU0GP+Bu+wLi109CzUZUwW6c5G2p0riWUY41bwrJRxxRYph:tSA/JpfHpzz
- TLSH T1A734DF52B3F89A44F6F33B385D7286A44E76FCA2ED34C65D2264780E2C71A5488B0737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\FEXO.dll
- Size 276KB
- SHA256 6c52e3ca11c60f7ee2b149a7ba84279682785809e0827f2d0d54b86e3d7b1c48
- MD5 1b7e447a48b6cc50f446404712927eca
- SHA1 ba9718c7d23a35df36ce345c46e1105e614a8403
- SHA512 40ced4b949cdde9148ff48eab23ddf1e9d47949c1f4c8b52e4aec210681dfd492aa51acd36856a41da1c1063f758c65df91e89a7472569dd2876eda7c2ec90d9
- SSDEEP 6144:ra8z7NS9Sb15YmbdnpHQGHpU0GP+Bu+wLi109CzUZUwW6c5G2p0riWUY41bwrJRO:FzxSA/JpfHpzz
- TLSH T19A54D052B3F89A44F6F33B385E7287940E76BCA2AD34C64E2664B50E1C71A54C8B0777
- MD5 SHA1 SHA512 SSDEEP TLSH