fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Size 132KB
Sample260924-1x8dpstanf
SHA256 fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f
MD5 820a0551586de8bbe2f2a2141e13d849
SHA1 254095a0aea707c021e47f38a12a0e9e67e62dff
SHA512 99318b36496f3f1cb5a4e451782727485e316dfb8f7701a03eea62619a6499fb0d59ee301b2e1313348e5cdd57d5db51597159478cf2d2997c940797884875bd
SSDEEP 3072:NanzK91SZotUI+SpNqi19s1Wz0LmwoB0+nApjMmnjes:N+ZSUIHmsW7FpjMuje
TLSH
T18ED3E171B4C2C571C8D702B9B5EA2AB3691E5F20128000CFAF945D5D2E20DF9AB7B367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000016d04-0.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
2040	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
2040	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5D4531A-09F3-47D4-87BD-CE40D8552C06}	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000016d04-0.dat	upx
behavioral2/memory/2040-2-0x00000000020C0000-0x00000000020FF000-memory.dmp	upx
behavioral2/memory/2040-4-0x00000000020C0000-0x00000000020FF000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5D4531A-09F3-47D4-87BD-CE40D8552C06}\InprocServer32	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5D4531A-09F3-47D4-87BD-CE40D8552C06}	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5D4531A-09F3-47D4-87BD-CE40D8552C06}\InprocServer32\ = "C:\\Windows\\SysWow64\\AppIdPolicyEngineAp.dll"	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5D4531A-09F3-47D4-87BD-CE40D8552C06}\InprocServer32\ThreadingModel = "apartment"	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2040	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
2040	jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd796e09fe6dc1a48793073d0e42a471514887af4738cc0b59d8cb1dad64977f.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AppIdPolicyEngineAp.dll

Path C:\Windows\SysWOW64\AppIdPolicyEngineAp.dll
Size 89KB
SHA256 1bfdaa6a4fc810a040607d633fc4eb842d1cb8fc81ff10dff06ce6db78cfd5ca
MD5 871f7bedfdb7075a4d5d53c6407b8937
SHA1 1f55b1aae42dd356e4026e3995e897fd1ee11010
SHA512 9b5fb8958073d5af4bc6b84476db6a3166cabdcf00ab5c995722b78606c44c27971a930defdde576dcb74389d5208c04e35557e38456d749c16c572ed515184d
SSDEEP 1536:46c2bcATlbcKNyRAOmHMtx+Ymt4tegxAjg3eI1XeTmoyRcj:4kI0tvwmsjearuIcyYj
TLSH
T1E193026A62293CE7D4C11471877FEB76137A0D21A8FD8EC38670880EADE3745DA41DD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-2-0x00000000020C0000-0x00000000020FF000-memory.dmp

Download

memory/2040-3-0x00000000020EC000-0x00000000020ED000-memory.dmp

Download

memory/2040-4-0x00000000020C0000-0x00000000020FF000-memory.dmp

Download