5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe
Size 1010KB
Sample260919-gjbyssca25
SHA256 5b2268dfb40fc2f37f2b338c0511b629ea3fa3c1ffc069a193be5e7476504e46
MD5 6ddcef131154ebf4843161cf11c72a3a
SHA1 139dedb0697382fb5acee003472969ce8cb9d694
SHA512 13bbf957e507de33258be7685d940202321cf14194f2513246a2e77bf4ea6c8f90c1b64f216567b956d6bc6b72abee3c38b11252e5b76006575ac4039d5c27fb
SSDEEP 24576:VSPz6gtnqXtnr/AwQOdOwRVlN3L1qC0EFl:Ozj0XZTOwvn3L1qEl
TLSH
T1D5258C42BAF1C17AE5A342700D76C719A672BD955B3586CB73C03E0F7E312D29A3A316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1860	svchost.exe
5556	Set-up.exe
1400	messenger.exe

Loads dropped DLL 7 IoCs

pid	Process
1860	svchost.exe
1860	svchost.exe
1860	svchost.exe
1860	svchost.exe
1860	svchost.exe
1860	svchost.exe
1860	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\messenger.exe = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Components\\messenger.exe"	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	messenger.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c00000001b2c5-6.dat	nsis_installer_1
behavioral2/files/0x000c00000001b2c5-6.dat	nsis_installer_2
behavioral2/files/0x000d00000001c480-42.dat	nsis_installer_1
behavioral2/files/0x000d00000001c480-42.dat	nsis_installer_2

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5556	Set-up.exe
5556	Set-up.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 1860	5960	jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe	89
PID 5960 wrote to memory of 5556	5960	jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6ddcef131154ebf4843161cf11c72a3a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:1860
- C:\Users\Admin\AppData\Local\Temp\Set-up.exe
  C:\Users\Admin\AppData\Local\Temp\Set-up.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5556

C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger.exe

Path C:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\messenger.exe
Size 91KB
SHA256 66474cbf47bf554c5bfdd62ea39b864096667fbb7d77c5103eb874e0c81cbe97
MD5 fc6e4175f214b4cfb15504d6c43f5e66
SHA1 fba7ae4e5ee7a5c13e37688856abe8052469f788
SHA512 ecc99c27c9f8c0f0edc0a6f87119675725f7028b86f27c1ee53169ec29c0f406b1cd1ee43b655dd62295a71bef012e61fdc23eef845d0f82c10a3f07fcac741f
SSDEEP 1536:hpgpHzb9dZVX9fHMvG0D3XJHZzkF47BLPkqIzjbanya/x6s+bMnb:bgXdZt9P6D3XJ5zkFQP5Kyx3tnb
TLSH
T10793E056A1C148A7C9D6033065B7A739F3F6C6DD03A15A430BAC3F7F1D21293CC1A6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Set-up.exe

Path C:\Users\Admin\AppData\Local\Temp\Set-up.exe
Size 793KB
SHA256 6be35fe8543aecfe21ece4a1077373a760e6d22012b32fb19a7a53ef15445b3d
MD5 9209338186015547dc9cd90258da09e4
SHA1 a6f17d98b85ae07d2962296a25a9e04f35463dae
SHA512 d7fb31b050dfa7bf31bcdf35650076ba431aca2af293efa0ff85936c387ed70eacb05820b796130b8d7e35307b7a217c1b4eed20298e1c53ed272f19c37855db
SSDEEP 12288:C/AwQ9izQ46IOwAyKm9vRlN3LUcqC0EWUl:C/AwQOdOwRVlN3L1qC0EFl
TLSH
T194055A41BBF1C17AE5A346704D76C719A672BD915B3196CB77C02E0F3E312C29A3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISArray.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40B9.tmp\NSISArray.dll
Size 19KB
SHA256 6a129a9eefae85a9412e889e0c74fdaa21d20254fa13cacef5429885775017dc
MD5 14b848866035dea39b912da628307231
SHA1 d00c8963aee8038d8a22f098cef69b31007196e5
SHA512 4538058426c742bf7d823d1cac5303eeff8bf0b524459262181ac79695eead705e7590ae63ce996b8e3afd9a6c8d1fec503f9a11772ebe5c5c4e01930ed97b16
SSDEEP 384:J+o6oNJDOD4mqjCQ2UcW3++Mnnm8GPHltUIH4qpjiX:gDoNJyD4mqjCOsnmtHltUIYqFi
TLSH
T14A92D9BB4710A4F0D37E2879FBC99A1F897E311064A5D4E7CB775F898F1014A1B76212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nso40B9.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 154KB
SHA256 0bab3a2fafdfd026026ed1f3e689febfff17e61d7f1c23501a5accebc8300119
MD5 024a2fbda97eeed3d5ee557739760c60
SHA1 81f98ba5358b08eab4b83937306364b9160a69e9
SHA512 e0fec6e5cb70f3377c5995ed532c29765e98148fa9892707c72614392b557a50d3cf5fb20932443b166e2be09950b2aa77d899c34a36339c508e8d7d1e6b154f
SSDEEP 3072:bgXdZt9P6D3XJT6bFQP5Kyx3tnviuD1AUlSjRtVkk5Kyx3tnC:be34d6SUyZtnviu1AKkUyZtnC
TLSH
T162F3F19691D25857D4D603306A3B5735B3B18EDD4360918317BC7FBA0FA63A3CC2AA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5960-0-0x0000000000431000-0x0000000000432000-memory.dmp

Download

memory/5960-43-0x0000000000400000-0x0000000000441000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads