2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe
Size 28KB
Sample260924-d2bh7sda79
SHA256 2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce
MD5 1d3f37fa87ac76de81806804ae249ad2
SHA1 6b35d7b9288f52d46a367f8572cfd0a858a0dc96
SHA512 852c4888cc5fcb439510cbb96fb9eb1df630ffd2170bec4c5ef41598e6a7c7cde0f68e6c927ff05a5cca0c318fb72db0031050e8ec91defcbdec7ca9477049f9
SSDEEP 384:8y/sea1Xw+kF2rmWrgOE6ig821s+LHNhXm/D1D04Q:Hsea18Qr303C82M11Q
TLSH
T119D252797658E63AF014C7FB292981D42499383626D9F45BFB0AAF183DF40D2D69070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = " C:\\Program Files\\Internet Explorer\\SIGNUP\\conime.ex"	conime.exe

Loads dropped DLL 1 IoCs

pid	Process
4560	conime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\urlmon.dll	conime.exe
File opened for modification	C:\Windows\SysWOW64\down.dll	conime.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conime.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4688	taskkill.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2996	jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2996	jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe
4560	conime.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 4560	2996	jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe	90
PID 4560 wrote to memory of 4688	4560	conime.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2d640aa0aab860068e07234aa7bcd5862a988a0173da54780467d7950cc1d3ce.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files\Internet Explorer\SIGNUP\conime.exe
  "C:\Program Files\Internet Explorer\SIGNUP\conime.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im rfwsrv.exe /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

down.dll

Path C:\Windows\SysWOW64\down.dll
Size 1.6MB
SHA256 6fa8067ba6578f507c32708fcc3f63744f8cef6b07dfff9773938305fefe7ef8
MD5 b179b48b2bc47d3425f352e2ea835888
SHA1 fb3df423107d6200ce0add85109954b8e5aa373f
SHA512 74070e4bd31a6a6020de7367766a893a5d3dbb37a99d789d18937fe8e6317429f3a1afc531f22866f1fe97a50057058356c0268fb7c25a3f53f36184623d6773
SSDEEP 24576:T+VsJ/kpIqwCXKQROU9Pvo34YZGDX4I414TCloWIsCY3AH387nSpHs5H0ff:THJ2/9zHBuSNHs7nsM5Hy
TLSH
T17B758C25E5B59061ECF319F0852EB732152D5CA22B6040E7F3E2EBE564B42D06E363B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2996-5-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads