Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 22:48
General
- Target jaffacakes118_0d6064c4089afa21ddab7a5aeace55e93537627deae038c1f6ebd3590d4214f4.exe
- Size 2.2MB
- Sample260924-2rjc3ayvcw
- SHA256 0d6064c4089afa21ddab7a5aeace55e93537627deae038c1f6ebd3590d4214f4
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Themida packer 20 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d6064c4089afa21ddab7a5aeace55e93537627deae038c1f6ebd3590d4214f4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d6064c4089afa21ddab7a5aeace55e93537627deae038c1f6ebd3590d4214f4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\eapi03.exe"C:\Users\Admin\AppData\Local\Temp\eapi03.exe"2⤵
- Executes dropped EXE
- Identifies Wine through registry keys
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\HamachiSetup-1.0.1.5-en.exe"C:\Users\Admin\AppData\Local\Temp\HamachiSetup-1.0.1.5-en.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HamachiSetup-1.0.1.5-en.exe
eapi03.exe
memory/2028-33-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/2028-8-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/2028-17-0x0000000002590000-0x0000000002686000-memory.dmp
memory/2028-16-0x0000000000D10000-0x0000000000D11000-memory.dmp
memory/2028-19-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/2028-18-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/2028-20-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/2028-28-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-44-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-60-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-68-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-66-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-31-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/4004-30-0x00000000045C0000-0x00000000045C1000-memory.dmp
memory/4004-35-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-64-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-36-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-37-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/4004-62-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-52-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-41-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-43-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-58-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-22-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/4004-46-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-56-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-48-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-29-0x00000000045B0000-0x00000000045B1000-memory.dmp
memory/4004-50-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4004-54-0x0000000000400000-0x00000000006FB000-memory.dmp
memory/4696-49-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-53-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-51-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-55-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-47-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-57-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-59-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-45-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-61-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-42-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-63-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-40-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-65-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-26-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-67-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4696-32-0x0000000000471000-0x0000000000472000-memory.dmp
memory/4696-69-0x0000000000400000-0x0000000000472000-memory.dmp
memory/5656-25-0x0000000000400000-0x000000000040F000-memory.dmp