4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Size 140KB
Sample260924-2sa33stfkb
SHA256 4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c
MD5 2f1995162ea934958112ccf4aaa740ac
SHA1 6e6d12b7bf59113bbd22becb39149fb876167142
SHA512 35c804767cccb38fb648e55466c904e4e8755c26c7ba8302785b908f17a45a9e9123dc6313fb2f3f30760d13d3dec9b6c992392c93779a8b12b6a0de725a52fb
SSDEEP 3072:wc4QmATcnC0K5jBIQGc0SxXrsBZp6DZWdAJE2vxQ0o4:j12nFl20SGp43v
TLSH
T1E6E3F121B9D28526DDF701F540F6AF2B885E7A7912A0008FD7805E6E2E61EED9133773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00050000000228e8-2.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
4692	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
4692	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe

Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9547B7AB-433C-40F7-9E88-8EB31C1B101E}	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000228e8-2.dat	upx
behavioral1/memory/4692-5-0x0000000000500000-0x0000000000541000-memory.dmp	upx
behavioral1/memory/4692-9-0x0000000000500000-0x0000000000541000-memory.dmp	upx
behavioral1/memory/4692-11-0x0000000000500000-0x0000000000541000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9547B7AB-433C-40F7-9E88-8EB31C1B101E}	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9547B7AB-433C-40F7-9E88-8EB31C1B101E}\InprocServer32\ = "C:\\Windows\\SysWow64\\adprovide.dll"	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9547B7AB-433C-40F7-9E88-8EB31C1B101E}\InprocServer32\ThreadingModel = "apartment"	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9547B7AB-433C-40F7-9E88-8EB31C1B101E}\InprocServer32	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
4692	jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f6ee3c29fe74914f52a1eaa7b3b4bff92f29beb178b32939c217298c7e9467c.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

adprovide.dll

Path C:\Windows\SysWOW64\adprovide.dll
Size 94KB
SHA256 b32612eeda77c7fc0ced1ab33d4ceeb2065622b923fb4d490661c891f8d4181f
MD5 f6d5e44d37f17967653f4c8db4c4d444
SHA1 09809cea59356485c629bbfbc085a916605c0152
SHA512 a6a6e76c47e3ab5da28ac6afb7fa5ee3e6a102b8f4d56b4d24fbe26b22c6274a55bb9527d44b73318ca001ca7f7e447214423288ecc2808b333fb398833af5eb
SSDEEP 1536:oS+wFN2tMW1XHzpTBGsmUKyUa7kv+f67uhUBHwWETZ8mlazUslq60c0Vn6:2SN271XH1YsmJyZ7ZyUG5E98mwJlV0cH
TLSH
T1E793120622E037CED2EE973A1F37EA736952E2040B7D5A0621F4B46D1C67A966C1C1CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4692-8-0x000000000052E000-0x000000000052F000-memory.dmp

Download

memory/4692-5-0x0000000000500000-0x0000000000541000-memory.dmp

Download

memory/4692-9-0x0000000000500000-0x0000000000541000-memory.dmp

Download

memory/4692-11-0x0000000000500000-0x0000000000541000-memory.dmp

Download