d3c578a3758d777dfc55c6220d4fd65e3322b6a5bd5c9f91e0be8d7d4448fe24

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
Size 62KB
Sample260920-3a76jafp3v
SHA256 d3c578a3758d777dfc55c6220d4fd65e3322b6a5bd5c9f91e0be8d7d4448fe24
MD5 2a3ad08c3a184f299ce469e3734bbd46
SHA1 08d738cea7ddb61a861fa5c53195c90f6c8b3e61
SHA512 50519cc522fdde711ab2a8e3e1f7942f72d2ddf658169dfd03ab389948fb55e556dd2a5e09aa4b1d0f238faf2532ef662558fb6a16a101b1da7d481d94c66145
SSDEEP 1536:icYylRlKUl3jyhvzLeNpt9yS+XMFn2d+:B5Rl530rS59yDCn2d+
TLSH
T1D4539E13B2DA2E60D2B505BD700FAF7A81A1E8276C35D380EB7F4753C5B8F1053A5266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware stealer upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe:*:Enabled:ldrsoft"	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4540-0-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-1-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-3-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/4540-4-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-5-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-6-0x0000000000400000-0x000000000145B000-memory.dmp	upx
behavioral2/memory/4540-8-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-9-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-10-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-15-0x0000000000400000-0x000000000145F000-memory.dmp	upx
behavioral2/memory/4540-16-0x0000000000400000-0x000000000145B000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5652	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 5652	4540	jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a3ad08c3a184f299ce469e3734bbd46.exe"
1⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE00.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JAFFAC~1.EXE00.bat

Path C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE00.bat
Size 192B
SHA256 5eb65f36b7e96c4f18cffd5964ea743e5faaf262614cf526f32a7e7be5da96af
MD5 164a393013b847c0bd372220c470d8b4
SHA1 9f5cd3b06603959ca61ac794b58eafbfb1128ca8
SHA512 43ebb8430420293aeec9efe07a084593008f9170300665c69bfbe443d03e0e292b7f167c1d88e7b4e82602194a4bea5a45fddacc5f053ef45338c2b8767d6723
TLSH
T1C1C01201C1D7A61F1988735B16A1D94CC074D8AC2B8E3B31E668842D316144DE5C7B06
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-0-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-1-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-3-0x0000000000400000-0x000000000145B000-memory.dmp

Download

memory/4540-4-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-5-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-6-0x0000000000400000-0x000000000145B000-memory.dmp

Download

memory/4540-8-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-9-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-10-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-15-0x0000000000400000-0x000000000145F000-memory.dmp

Download

memory/4540-16-0x0000000000400000-0x000000000145B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads