Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/09/2026, 19:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe
- Size 57KB
- Sample260920-xyftascn21
- SHA256 ed75df50175a137713f2f21b9723746941791db53379b7ebd16f52faa87c3424
- MD5 2bff287ca00928ba5047219cde8eadb2
- SHA1 00ce61253cb560fa479df60808e67147e08e9130
- SHA512 6fb61788f2cdce641404f0ad333fddba05058d4ee9ab8f6091f8fd93e9eb4e5b1cfd1cabcff9e59e13c847ef9687b28dfe0d6112c3630b3f3267b602ddf7acbd
- SSDEEP 1536:jdzCU+0hpdBbFprEhzbGuRXHvWLEbCX444hAlk/z2j:jlC27d1r85+LEbCX44186j
- TLSH T1DC43CF936A91C27BF0146571366669F1EA2EF945CE9044DFCE86FE7D24F18A05CA3308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 3 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\COMSysApp\ImagePath = "C:\\Program Files\\Common Files\\Microsoft Shared\\xanavg.exe comsysapp" regedit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\COMSysApp\ImagePath = "C:\\Program Files\\Common Files\\Microsoft Shared\\xanavg.exe comsysapp" regedit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\COMSysApp\ImagePath = "C:\\Program Files\\Common Files\\Microsoft Shared\\xanavg.exe comsysapp" regedit.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation rundll32.exe - Deletes itself 1 IoCs
pid Process 5736 rundll32.exe - Loads dropped DLL 3 IoCs
pid Process 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe 5640 rundll32.exe 5736 rundll32.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\xanavg.exe rundll32.exe File created C:\Program Files\Common Files\Microsoft Shared\xanavg.dll rundll32.exe File created C:\Program Files\Common Files\Microsoft Shared\xanavg.exe rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regedit.exe - Runs .reg file with regedit 1 IoCs
pid Process 5672 regedit.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe 5736 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe Token: SeDebugPrivilege 5736 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3076 wrote to memory of 5640 3076 jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe 90 PID 5640 wrote to memory of 5672 5640 rundll32.exe 91 PID 5640 wrote to memory of 5736 5640 rundll32.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2bff287ca00928ba5047219cde8eadb2.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\xanavgreg.dll",polmxhat2⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\SysWOW64\regedit.exeregedit.exe -s "C:\Users\Admin\AppData\Local\Temp\xanavgreg.reg"3⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
PID:5672
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\Common Files\Microsoft Shared\xanavg.dll",polmxhat3⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\xanavg.dll
- Size 64KB
- SHA256 9d553491e92b57254697d7439484aeb09b55e9f863ad84d87a2762e77a62b496
- MD5 130488913216626636e2be49fc84d66d
- SHA1 04784dedc389105ed12a666daa51ea14164101dc
- SHA512 0a1f1e43fe05cd8b31607b918f88386321bf43ada6917bb2d8566db1ec7bbaeddec4e6f7e4ab25edd1a958938410042b661a2c7540530f4d992a54b68622cce7
- SSDEEP 768:mkrpisvuzgdwMG9hl7c1McuEcnr99AOFbFprep38pBRCwBqcqZkw5:jrplSbm1a3AOFbFpr4MpCkqrZkM
- TLSH T144531916968107EBD215ED76B69ABF37C6621D1002925683A793FF7838B3082F716F07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xanavgreg.reg
- Size 1KB
- SHA256 dca5b7053d3df16d246ec67af91f0c1cc7218f48b3f167cbbde8215008e87366
- MD5 398d40590e99023f70c6559ea8c3bcf7
- SHA1 7512a2228b91c1147400e69238f0da7463d77c74
- SHA512 0876766b91777e3a88b1d2191abae0412ea9c207f7cc3be7bd62a8042aa63ecbf7bc35aac85a85927149d0e3ba8a41e21495eccc11b70fa3493687350350efd8
- TLSH T18D31EBA23669C6CEC9E15C40D719BA43225AE5A78FCC950F71F0CC45A3FBD16201E7A3
- MD5 SHA1 SHA512 TLSH