a2582af23581d5f6d5d5ef7d67b4a9e43c10f8aa99d27300a733a900b6e7e9a5

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
Size 156KB
Sample260919-fpwpqabe86
SHA256 a2582af23581d5f6d5d5ef7d67b4a9e43c10f8aa99d27300a733a900b6e7e9a5
MD5 6a9dd855ce575d055bd1c036846253d4
SHA1 e8d57b3573fd2693356d1a5171bd258e2af3a462
SHA512 fc93286b2b01912333005600e6f5bc2d5b09692f88c305ae736a177f7df045ad8989e0624c8f578411c316ba0b20e9a6f6aee38cb528121446825d2a71330018
SSDEEP 3072:cxRn5efUkuUx/loYl36iqlekwohWv6pcDordSD1E5j4oQd:SJiUk/dlb+wohQxDopdi
TLSH
T125F3942676C0F63DC415C6F83D2A8790A436ED3525E29813F6C22F26B6F5EA7D221317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	caialan.exe

Executes dropped EXE 1 IoCs

pid	Process
3268	caialan.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /s"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /Y"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /q"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /a"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /i"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /A"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /X"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /V"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /h"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /U"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /c"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /n"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /D"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /F"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /e"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /A"	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /v"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /N"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /j"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /o"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /w"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /I"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /l"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /R"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /B"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /S"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /L"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /x"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /g"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /m"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /r"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /u"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /O"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /Z"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /k"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /K"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /z"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /E"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /M"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /G"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /C"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /Q"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /P"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /H"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /y"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /t"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /d"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /T"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /p"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /b"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /J"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /f"	caialan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\caialan = "C:\\Users\\Admin\\caialan.exe /W"	caialan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caialan.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2136	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
2136	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe
3268	caialan.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2136	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
3268	caialan.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 3268	2136	jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a9dd855ce575d055bd1c036846253d4.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\caialan.exe
  "C:\Users\Admin\caialan.exe"
  2⤵
  - Modifies visibility of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caialan.exe

Path C:\Users\Admin\caialan.exe
Size 156KB
SHA256 d413b289076770ee0e1bdd8bf2002f4d5819155d2a76ed377c72322c8a283e56
MD5 a39761ae2cecccf04fcccfebb10ab15f
SHA1 4f87e29a8e03008968f8f3818636c9876772bdd9
SHA512 08e34a1df0673c9cec1e494d203d6382a2237397e6d2e41bfa695fb3693ceeda2830d76be62bdc56f3bb55748cee45ac979be6a3132a6de376fff39c059be8a9
SSDEEP 3072:cxRnyefUkuUx/loYl36iqlekwohWv6pcDordS4NE5j4oQh2:SJDUk/dlb+wohQxDomd
TLSH
T1BEF3941636C0F63EC415C6F83D2A8790A436ED3565E29813F6C22F26B6F5EA7D221317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download