373bbda71cd55e71fcbc2fd55c7b1e60565c3156b798b1fd8ccb849149cbe2da

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Size 852KB
Sample260920-2ldkmafk2v
SHA256 373bbda71cd55e71fcbc2fd55c7b1e60565c3156b798b1fd8ccb849149cbe2da
MD5 290e05c29afd26d9553f55779dd52e09
SHA1 be72b3b6cdaa16baa4d49cdfe98e3b9466c19d1f
SHA512 e190a5e42016f700edfd53fbf60976dfaf298407eb959831090beb77a577c7efe9b8321517e9eee7803e31d4adf7d17a11d66e0e034b7472f89783e137f0507b
SSDEEP 12288:MF6wGViGnvZGdkleLEg6YzltyP8idmUdxwer8czmz8CpknCT5xGhY38QTS:g6wyiGRl3Yz2mUdxwj0g8Rm3GhG2
TLSH
T11A0512A22AC4085BD8D5253005EB15CED47BCF503C1BEE2B03A2B65E2CB66748E5FE75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c4ef-13.dat	acprotect
behavioral2/files/0x000d00000001c4f0-25.dat	acprotect
behavioral2/files/0x001000000001c4e5-37.dat	acprotect

Loads dropped DLL 10 IoCs

pid	Process
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uqlzj.dll	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
File created	C:\Windows\SysWOW64\tmpad.xml	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4092-10-0x0000000000400000-0x00000000005F6000-memory.dmp	upx
behavioral2/files/0x000d00000001c4ef-13.dat	upx
behavioral2/memory/4092-16-0x0000000010000000-0x0000000010011000-memory.dmp	upx
behavioral2/files/0x000d00000001c4f0-25.dat	upx
behavioral2/memory/4092-29-0x00000000029C0000-0x0000000002A2D000-memory.dmp	upx
behavioral2/memory/4092-28-0x00000000029C0000-0x0000000002A2D000-memory.dmp	upx
behavioral2/files/0x001000000001c4e5-37.dat	upx
behavioral2/memory/4092-38-0x0000000004A00000-0x0000000004A4E000-memory.dmp	upx
behavioral2/memory/4092-41-0x0000000000400000-0x00000000005F6000-memory.dmp	upx
behavioral2/memory/4092-79-0x0000000000400000-0x00000000005F6000-memory.dmp	upx
behavioral2/memory/4092-91-0x00000000029C0000-0x0000000002A2D000-memory.dmp	upx
behavioral2/memory/4092-92-0x0000000000400000-0x00000000005F6000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\QMDispatch.dll	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3332	4092	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\DOMStorage\vrbrothers.com	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\DOMStorage	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\DOMStorage\vrbrothers.com\NumberOfSubdomains = "1"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID\ = "QMDispatch.QMRoutine"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32\ = "C:\\Windows\\QMDISP~1.DLL"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\InprocServer32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\VersionIndependentProgID	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\ProxyStubClsid32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ProxyStubClsid32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction.1\CLSID\ = "{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\CLSID\ = "{C07DB6A3-34FC-4084-BE2E-76BB9203B049}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMCore.QMEngine\CLSID\ = "{EBEB87A4-E151-4054-AB45-A6E094C5334B}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\InprocHandler32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction.1\CLSID	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\ = "QMDispatch 1.0 Type Library"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\FLAGS	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\ = "IQMFunction"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\ = "QMFunction Class"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\InprocServer32\ = "C:\\Windows\\QMDISP~1.DLL"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\Programmable	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\InprocServer32\ThreadingModel = "Apartment"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMCore.QMEngine	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JAFFAC~1.EXE"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\ = "QMFunction Class"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\InprocServer32\ThreadingModel = "Apartment"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\ = "IQMRoutine"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\TypeLib	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib\Version = "1.0"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CLSID\ = "{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF94624F-EAAE-47CA-BE5B-86FDBF0B2BBA}\ProgID\ = "QMDispatch.QMFunction.1"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\ = "QMRoutine Class"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine\CurVer\ = "QMDispatch.QMRoutine.1"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C07DB6A3-34FC-4084-BE2E-76BB9203B049}\TypeLib\ = "{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID\ = "QMCore.QMEngine"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMFunction\CurVer	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5FD5723F-D6F6-4F31-A7D0-318E72D28E80}\1.0\0\win32\ = "C:\\Windows\\QMDispatch.dll"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\ProxyStubClsid32	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}\TypeLib\Version = "1.0"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMCore.QMEngine\ = "QMCore.QMEngine"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\ProgID	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine.1\ = "QMRoutine Class"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMDispatch.QMRoutine	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF4F905C-0961-4464-8460-DD2A1F274D1F}\TypeLib\Version = "1.0"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6AD2DF7-46DC-417F-AE61-D433C510416D}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBEB87A4-E151-4054-AB45-A6E094C5334B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe"	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0E59F1D5-1FBE-11D0-8FF2-00A0D10038BC}	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
4092	jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__290e05c29afd26d9553f55779dd52e09.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 3024
  2⤵
  - Program crash
  PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4092 -ip 4092
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSSCRIPT.OCX

Path C:\Users\Admin\AppData\Local\Temp\MSSCRIPT.OCX
Size 100KB
SHA256 d493f101ccd1d8804c0981f4fc630718b267d7155bdb575d6f619497956ea44e
MD5 656524b4401f21e2929b78ef4c36db27
SHA1 d91ff837d6ced5f0442fd0812b6c1079fe417906
SHA512 d28b17c924fb5f172944c055a85003575300305eddbbc4c89460777108c87154622b39515ee1f994d713d790fe5b74a69c835bd00d0affc5292fa0150617c34c
SSDEEP 1536:xr/HCcXUN/mluqopn1wc18na8UMaLBJLB3aVbC:p/CAllEKc2nrUMaTLB3
TLSH
T1E1A30712B690D271D4E620B4892EB3B511AEECA05F2652D762443BEDECB17D0DE346CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinIo.dll

Path C:\Users\Admin\AppData\Local\Temp\WinIo.dll
Size 60KB
SHA256 b0423fa0bfa4efce8d60b13ba4a7e5f3a0e1ce5605767c0c3d4698fd940ead3e
MD5 c604a51bd265526800ddba9f0ef730df
SHA1 40804d3a9047b050f5dcd444c55ce3cd2c374d97
SHA512 1e048ba803a8e778907b6050edff2aed81bf2237109d948fa779452c5f99ced1802a4fda082bf4420c29fb39b2a1996ef39653ea3af2262902e6433cfb87f8f5
SSDEEP 768:ARn3ftwizTgXqcgte6zTh7OCfKoiyx9j3oVtCPr5aDrtFxEoE:8n3VwizTgie63ICbrqVAPr8tLEZ
TLSH
T146534944E981C1E7E4AD42B19DA62739963A7A1007561FC3339DABA13E232DCBD3174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfgdll.dll

Path C:\Users\Admin\AppData\Local\Temp\cfgdll.dll
Size 36KB
SHA256 a2e88bff39817950b89293b10c7775d113a07402625e21c16a23ed47d088a1c8
MD5 98e900c04b9ab84405b224af31b93b65
SHA1 3a7b1dfd8c5d57cce94fdf8f8b4dac3470833017
SHA512 a9627d29787cd57f878bab9f4883475378105232ff42a0ba653969413c15e68b5ab2b4ceb02918dc8e243822e5273825b2766d58ca4dbe90c3d252c2d96343a2
SSDEEP 384:BN2JfgeITZSQy2REf9UZqd9JHmlhGoiixyJvPYpo9vDkzUsxchvYo9AgEnHD7aS:XLeITZSv2CVUZqTJ1U4HY+reqYo9WDN
TLSH
T1DCF24B61798106B3C24F923596A8BF27597F98611BF04843DB6299CA1D723F1FA2B343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cooper.dll

Path C:\Users\Admin\AppData\Local\Temp\cooper.dll
Size 90KB
SHA256 a29f8373ecc158f6bf9a8f038844859842c8823a03e2b950c8a9fd8ee292672f
MD5 fe550544e19f6c293f4ed7e0d5e25618
SHA1 51960d9334ea7af42e55218c4446591ecb1f5606
SHA512 c3facbd6586912c4fa612b473d99f11f0cc6d1ca84bff9388049042d17b39496ffab092238b451ee77799f4b7c7cd3234ced18831e54397f54611c77d788dacd
SSDEEP 1536:vtqJbolVh6lqCI5n+35uOgQKEjvBKxSw3axPRfxe5zBqMQ1GH:VUfKYJ7tjUQwUPlYB6I
TLSH
T126931216B7EA6625ECA5DC3D0EF1CD161254DF16973BA30C2980B81C6870CB1DCD6DA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.dll

Path C:\Users\Admin\AppData\Local\Temp\helper.dll
Size 20KB
SHA256 f02409b2e367afd0e585a2e1c6ac4d10790fab5292d8d1c2b866fe04fab28d4d
MD5 87e96b9b1540adb0c01aa48947967666
SHA1 cf630e13f5ce321c54de09d6ed24792282b05aa3
SHA512 0b0fd2d03eb7fb255e283b387b2dd08390ff1ce5f0d47ee5a698b809e73e1c4f484c6970817c64af00531ac938ea5f1970de2a2ccfca769f135adc011e96a3ce
SSDEEP 384:8/RGnxdrDQ/wmwZkxIGuBoQ+Ey5955cpgm+EYBln:8/ExdrDXm55ag1EYBln
TLSH
T13C92E165F0B54F55E90165332F484217BF899C6292479B2737DE814B0CC1BB009F3B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

macroinfo.dat

Path C:\Users\Admin\AppData\Local\Temp\macroinfo.dat
Size 590B
SHA256 f9c431255bce695e1386a460c21215c16c2983630841e3a69213c848a9742166
MD5 e7e61840c44b6e2ddf553a3cc8f67de7
SHA1 6434f084b008bd5ec016e4577d84087243d8e321
SHA512 69194f1f465a1205db36c4ba0386b61ced1d9e5663c6284d432037106eaec18fa1bb0b976ba53881e2d995458e7511905f6ae7bf3513f937d56d243a8c480eb9
TLSH
T187F075DA015962EECD38D8318933509DAC4200EB4072C5B1351F41DDDB483FCF82AC0C
MD5 SHA1 SHA512 TLSH

Submit Download

QMDispatch.dll

Path C:\Windows\QMDispatch.dll
Size 107KB
SHA256 1e8e62d6ea8233a6351f9e0a82e95fb0245281b7d32a2c788261d9feb08e71ac
MD5 8e6e1a1d29ddc38e120afc606ce1d845
SHA1 5d9b8d4ccc4f74fd501a2ca377d858ee93252a7a
SHA512 b5c06636ab42b1925f3bcf2a872c3cb0ab7876a0eb88ff6009e3eeea4d3c7f3007d8eef6ca2f5e4b769bf73dde69dca564978cd49f98b1f9bcba49e9258f4f31
SSDEEP 3072:Nb32BP3PB1I+3iavjyCjGB8CyFiOq9KvLsgfQ:t3cfB1mavq8CN3kvLs
TLSH
T14EB302E2B68988BBD55896353F9362CA180A8D005E1B6F331369778F7C396643E031F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4092-39-0x0000000004A4D000-0x0000000004A4E000-memory.dmp

Download

memory/4092-20-0x0000000002870000-0x0000000002880000-memory.dmp

Download

memory/4092-29-0x00000000029C0000-0x0000000002A2D000-memory.dmp

Download

memory/4092-10-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

memory/4092-38-0x0000000004A00000-0x0000000004A4E000-memory.dmp

Download

memory/4092-40-0x0000000000469000-0x000000000046A000-memory.dmp

Download

memory/4092-41-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

memory/4092-28-0x00000000029C0000-0x0000000002A2D000-memory.dmp

Download

memory/4092-49-0x0000000004A00000-0x0000000004A09000-memory.dmp

Download

memory/4092-16-0x0000000010000000-0x0000000010011000-memory.dmp

Download

memory/4092-79-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

memory/4092-91-0x00000000029C0000-0x0000000002A2D000-memory.dmp

Download

memory/4092-93-0x0000000004A00000-0x0000000004A09000-memory.dmp

Download

memory/4092-92-0x0000000000400000-0x00000000005F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads