7a2af7ce532276ac5cad2a2062cff09ed342421231988a7c820d72085e434f45

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Size 83KB
Sample260920-3n5mkaea74
SHA256 7a2af7ce532276ac5cad2a2062cff09ed342421231988a7c820d72085e434f45
MD5 1563651aecd6776c8d5d9e1dc9649ea6
SHA1 fce5bffa0b3a994457b4ddc9dbe3ff1c43902261
SHA512 4fbd7104e5d65dd23fbb70bae348a2778b23cdfb373ed1cf54c25145d466b3019d4ab53ecf135a66753df2263bf5b6a9af950beff6e14c04fa762c4adabc4d1a
SSDEEP 1536:vhEcmDMAX2DrMSyh6NjJsjSbrQFDO0pjEErxTWDTMqhGKYIZTET8bDQ:p1mDMAXoyh69NQ4kjBkMqhGKZTbbc
TLSH
T11883D0FF41604F85FA973A39341D869AB97D148C32FA214B28781ACFD2E0A55F76E4C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "bblhhewstkjbkbhk"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "eqwbxrtwlqthehlh"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E60505E-F4C0-E016-4E87-25077F75443E}\ = "jsbnhebqznerjtns"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "hchtknebwjerltjn"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "skhbrhsqweenltxe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "lzklksskejctvknl"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "qqnlrnncnjrtbwwc"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "qetshbnzqlejkwkk"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E60505E-F4C0-E016-4E87-25077F75443E}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "qqsrteltkwscznqx"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "bqtbecewhnvvzbhe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "nncqnesrtejtlkkh"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "lqverntkknhjbvnb"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "wwlhthjwejhxhzce"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "tblscknrkkctcexk"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "shhhtcskeskqwnje"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "vetrbknsvzhtlsbx"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "ekqhlheshnnnsekc"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E60505E-F4C0-E016-4E87-25077F75443E}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "hekjxzelljlqctcb"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__1563651aecd6776c8d5d9e1dc9649ea6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5868-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5868-1-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-2-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-8-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-6-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-9-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-10-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-11-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-12-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-13-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-14-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-15-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-16-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-17-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-18-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-19-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-20-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-21-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-22-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-23-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-24-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-25-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-26-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-27-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-28-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-29-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-30-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-31-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-32-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-33-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-34-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-35-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-36-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-37-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-38-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-39-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-40-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-41-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-42-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-43-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-44-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-45-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-46-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-47-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-48-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-49-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-50-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-51-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-52-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-53-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-54-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-55-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-56-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-57-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-58-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-59-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-60-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-61-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-62-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-63-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-64-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-65-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-66-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-67-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-68-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-69-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-514-0x0000000000680000-0x000000000069E000-memory.dmp

Download

memory/5868-4993-0x0000000000400000-0x000000000042C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads