Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 12:19
Behavioral task
behavioral1
Sample
jaffacakes118__926869dcf3dea837c271e7403563bca6.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target jaffacakes118__926869dcf3dea837c271e7403563bca6.exe
- Size 295KB
- Sample260919-phl2daz1ex
- SHA256 02069b479fdb58ac3708547b76ff862a87adf129d78c23db456484a9bc405b83
- MD5 926869dcf3dea837c271e7403563bca6
- SHA1 1bb32799d3011bfc124b70be76af79e42ba35332
- SHA512 99a512c594f396987efcf9de839eb1b03286e667c72955a95083b589292dbd0ffa1d8205ff9eea82165635f577dc5a1d0abae5bad6b23b6b42adcde53ec94a9f
- SSDEEP 6144:Q1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59kIt:QjkArEN249AyE/rbaMct4bO2/Vd
- TLSH T1A954124032198CD5CAFE4A31B8D3CFA646E1BCB91D60921EF1D4FC3B35396275A5B298
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe J_Y.exe" jaffacakes118__926869dcf3dea837c271e7403563bca6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe J_Y.exe" J_Y.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe J_Y.exe" J_Y.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe J_Y.exe" J_Y.exe - Executes dropped EXE 3 IoCs
pid Process 5364 J_Y.exe 1368 J_Y.exe 1056 J_Y.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\SysWOW64\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\SysWOW64\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\SysWOW64\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\J_Y.exe" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\SysWOW64\\J_Y.exe" jaffacakes118__926869dcf3dea837c271e7403563bca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\J_Y = "C:\\Windows\\J_Y.exe" jaffacakes118__926869dcf3dea837c271e7403563bca6.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5364-14-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/1808-17-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/5364-18-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/1056-20-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/1368-22-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/1368-28-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/5364-27-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe behavioral2/memory/1808-30-0x0000000000400000-0x00000000004C1000-memory.dmp autoit_exe - Drops autorun.inf file 1 TTPs 26 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\c:\autorun.inf J_Y.exe File opened for modification C:\\autorun.inf J_Y.exe File created \??\d:\autorun.inf J_Y.exe File created \??\f:\autorun.inf J_Y.exe File opened for modification F:\\autorun.inf J_Y.exe File opened for modification C:\\autorun.inf J_Y.exe File created \??\f:\autorun.inf J_Y.exe File opened for modification C:\\autorun.inf J_Y.exe File created \??\d:\autorun.inf J_Y.exe File created \??\e:\autorun.inf J_Y.exe File opened for modification F:\\autorun.inf J_Y.exe File opened for modification F:\\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\e:\autorun.inf J_Y.exe File created \??\c:\autorun.inf J_Y.exe File created \??\f:\autorun.inf J_Y.exe File opened for modification C:\Windows\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\c:\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File opened for modification C:\\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\e:\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\f:\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\c:\autorun.inf J_Y.exe File created \??\d:\autorun.inf J_Y.exe File created \??\e:\autorun.inf J_Y.exe File created C:\Windows\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created \??\d:\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File opened for modification F:\\autorun.inf J_Y.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\J_Y.exe jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created C:\Windows\SysWOW64\J_Y.exe J_Y.exe File created C:\Windows\SysWOW64\J_Y.exe J_Y.exe -
resource yara_rule behavioral2/memory/1808-0-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/files/0x000e00000001c541-12.dat upx behavioral2/memory/5364-14-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/1808-17-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/5364-18-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/1056-20-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/1368-22-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/1368-28-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/5364-27-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/1808-30-0x0000000000400000-0x00000000004C1000-memory.dmp upx - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\J_Y.exe jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created C:\Windows\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File opened for modification C:\Windows\autorun.inf jaffacakes118__926869dcf3dea837c271e7403563bca6.exe File created C:\Windows\J_Y.exe J_Y.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__926869dcf3dea837c271e7403563bca6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language J_Y.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language J_Y.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language J_Y.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118__926869dcf3dea837c271e7403563bca6.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main J_Y.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main J_Y.exe Key created \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main J_Y.exe - Modifies Internet Explorer start page 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://famous2.topcities.com" jaffacakes118__926869dcf3dea837c271e7403563bca6.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://famous2.topcities.com" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://famous2.topcities.com" J_Y.exe Set value (str) \REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://famous2.topcities.com" J_Y.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 1808 jaffacakes118__926869dcf3dea837c271e7403563bca6.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 5364 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1368 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe 1056 J_Y.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6072 explorer.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6072 wrote to memory of 1056 6072 explorer.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__926869dcf3dea837c271e7403563bca6.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__926869dcf3dea837c271e7403563bca6.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
C:\Windows\explorer.exeExplorer.exe J_Y.exe1⤵PID:1360
-
C:\Windows\J_Y.exeC:\Windows\J_Y.exe1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:5364
-
C:\Windows\SysWOW64\J_Y.exeC:\Windows\SysWOW64\J_Y.exe1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:1368
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\J_Y.exe"C:\Windows\J_Y.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\J_Y.exe
- Size 295KB
- SHA256 02069b479fdb58ac3708547b76ff862a87adf129d78c23db456484a9bc405b83
- MD5 926869dcf3dea837c271e7403563bca6
- SHA1 1bb32799d3011bfc124b70be76af79e42ba35332
- SHA512 99a512c594f396987efcf9de839eb1b03286e667c72955a95083b589292dbd0ffa1d8205ff9eea82165635f577dc5a1d0abae5bad6b23b6b42adcde53ec94a9f
- SSDEEP 6144:Q1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59kIt:QjkArEN249AyE/rbaMct4bO2/Vd
- TLSH T1A954124032198CD5CAFE4A31B8D3CFA646E1BCB91D60921EF1D4FC3B35396275A5B298
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\autorun.inf
- Size 106B
- SHA256 052331e01023c3a7522c4cd5d40c918947218bb07cc239ecb336edc0cd761819
- MD5 00febd7ccafe8633512b6e3d3c2342d9
- SHA1 2bbfed4b582ea4289737329deeb43b1d2b25b136
- SHA512 f3eb24f51ce77e56120d45fd3eb9af56a9b0b20f9aa748c596ebcde702790ea2e4d549b2c9d4738f746bcc53e78a673f879d5c6af95ae0a4dbbf7592fdea405b
- TLSH T173B002D0F5FB894F964D345193810D72748B9744818C9C15C75CF8C8CD47355C7941D1
- MD5 SHA1 SHA512 TLSH