d1d5ea51075dad177786c8a9537aa8ab57820539adaa913afc9f51ccbb956191

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Size 76KB
Sample260919-ps33msck4w
SHA256 d1d5ea51075dad177786c8a9537aa8ab57820539adaa913afc9f51ccbb956191
MD5 93588ae255f59ad365c90c10ac6cc97e
SHA1 2cc730341212cb0cd52f5c629117e41565bab2ea
SHA512 9281e0bf70e5b011cc79ac68963ae32b946c9459137e9f4f3af3a7c41cc0713adfb7f365ea614b5a6f44ef6045b408bf9512431a07d2e9d987d2e142e5cb1cb0
SSDEEP 1536:lvwa1u8i6JuXGQtN6FTJW/JnODtXehUARTHuXpjVrs2ryrd1vUQuq6:ea1u8iNGQT6C/ct2lyHs2qo
TLSH
T10873DFFFD3235ED4E4DB2A39114D64DBF22A140E72E901F45C345AE9E0E4750AACC6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Contacts a large (503) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE563B53-AFA1-110F-005B-C3D0999E8057}\ = "eljhhsttzjkbelnc"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "bjjbttensrlwwtcj"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "lnxtrnlhevnrskes"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "ktrbjqhrhltrseet"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "bcnjnvrberstkskx"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE563B53-AFA1-110F-005B-C3D0999E8057}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "ensrtnhqjbcqkzsc"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE563B53-AFA1-110F-005B-C3D0999E8057}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE563B53-AFA1-110F-005B-C3D0999E8057}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "jwbsxqthtbnekvtq"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nklvxecqkvehsrre"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nkrbeklbesnexhlz"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "lklelncheswerjjt"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "lkenerssrkbcssck"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "nhewlsnrtjlkwwsz"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "qjqtkbntktvhlrtv"	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__93588ae255f59ad365c90c10ac6cc97e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4824-1-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-6-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-2-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-8-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-7-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-9-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-10-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-11-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-12-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-13-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-14-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-15-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-16-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-17-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-18-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-19-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-20-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-21-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-22-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-23-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-24-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-25-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-26-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-27-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-28-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-29-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-30-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-31-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-32-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-33-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-34-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-35-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-36-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-37-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-38-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-39-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-40-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-41-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-42-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-43-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-44-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-45-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-46-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-47-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-48-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-49-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-50-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-51-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-52-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-53-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-54-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-55-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-56-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-57-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-58-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-59-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-60-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-61-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-62-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-63-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-64-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-65-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-66-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-67-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-68-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-495-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4824-4223-0x0000000000400000-0x0000000000425000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads