d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
Size 304KB
Sample260924-dvkhjach44
SHA256 d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6
MD5 cf51913ae4715ac6e36284a0bb1a99ef
SHA1 c2e43aa468b2d0a8149a0cab58bfe527d2b409f0
SHA512 62b76c1e9ddff6ce60f2697b979dd19873f43859fe3635777c7d5d9e11d3f169ac84d3cf6d8d0a2bf4227e6199c89f5f33e2fd2f5d1af2abb3f76822fdfdc086
SSDEEP 6144:JSOf3vF/msL+9bGFUbct0atR94lbf/0BHbiILZLdb7x6:hvFeg+9bGFrR4x8HbiGZLdPx
TLSH
T1AF64F16170E180B1F2C24235F4693F11C7BFEE982A15986747643ACA6B7F1572B378A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx vmprotect

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1084	A_v_DVD.dll
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
2024	services.exe
4324	A_v_AuTo.dll
2168	services.exe
6048	services.exe
400	A_v_TT.dll

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/400-46-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect
behavioral2/files/0x000d00000001c467-45.dat	vmprotect
behavioral2/memory/400-47-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect
behavioral2/memory/400-49-0x0000000000400000-0x0000000000417000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Internet = "C:\\Program Files\\Common Files\\Microsoft Shared\\services.exe"	A_v_AuTo.dll

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c464-31.dat	upx
behavioral2/memory/4324-32-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral2/memory/4324-36-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Dw.ocx	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\services.exe	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.ocx	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\services.exe	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_bind.au	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Tj.ocx	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Au_ing_Code.ini	services.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_Dvd.ocx	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
File created	C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_TT.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_DVD.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A_v_AuTo.dll
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4324	A_v_AuTo.dll
4324	A_v_AuTo.dll
4324	A_v_AuTo.dll
4324	A_v_AuTo.dll
4324	A_v_AuTo.dll
4324	A_v_AuTo.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll
400	A_v_TT.dll

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	services.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
5100	2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
400	A_v_TT.dll
400	A_v_TT.dll

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1084	4356	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe	89
PID 1084 wrote to memory of 5100	1084	A_v_DVD.dll	90
PID 4356 wrote to memory of 2024	4356	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe	91
PID 4356 wrote to memory of 4324	4356	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe	92
PID 4324 wrote to memory of 2168	4324	A_v_AuTo.dll	93
PID 4356 wrote to memory of 400	4356	jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d108d52bb32a24aec294f2ca7940a4b8b3783a0c83f2f7ca530be65695899be6.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_DVD.dll"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Users\Admin\AppData\Local\Temp\2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
    "C:\Users\Admin\AppData\Local\Temp\2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5100
- C:\Program Files\Common Files\Microsoft Shared\services.exe
  "C:\Program Files\Common Files\Microsoft Shared\services.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_AuTo.dll"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Program Files\Common Files\Microsoft Shared\services.exe
    "C:\Program Files\Common Files\Microsoft Shared\services.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2168
- C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll
  "C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:400

C:\Program Files\Common Files\Microsoft Shared\services.exe
"C:\Program Files\Common Files\Microsoft Shared\services.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A_v_TT.dll

Path C:\Program Files\Common Files\Microsoft Shared\A_v_TT.dll
Size 47.7MB
SHA256 d995643b3f6e3a28e4a212b0c96d9dc36999eb5d50fd704a312ee7e993ce00f6
MD5 a4e2cea741b0d05343ec22c9ead272fe
SHA1 aa31347f022655c3ef6c60047b237d0da54263e1
SHA512 7d6b16e1eda4a459306f93498b8803b1a9b13bda8058fe13b6b38667874c5242812557b59c897497af1f3854c276427e906fdb64525569f440538190f361eff0
SSDEEP 12288:FKD37bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbu:0D3S
TLSH
T156B741562708C6B5E896AB3EBDD3DB1C7BF0FA191B32430766A53B790D23F846D14260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A_v_AuTo.dll

Path C:\Program Files\Common Files\microsoft shared\A_v_AuTo.dll
Size 47.7MB
SHA256 e20d55ab087fc2b7488feb7ed0802fbb2c9991371ce605a0028737a13312daef
MD5 2ef5e3720d72d653a0b82d514598fc2e
SHA1 847387bfa6c6aa4c1ed4a981d5f3551722b78678
SHA512 a320db0ddd5e9e6010d9320bbbd397a4ba205af7396cebf36f4c72a26a2d8d163fe53f1691c8f40f6555642625bc3ebe9cc86e451a7d7434dea788e69b33406e
SSDEEP 12288:8V+cIwrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrF:84bE
TLSH
T1BFB76165270CC6B5E4966B3EBDD3AB6C7BF0FA151B32830762A177B90D23F842D54260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

A_v_DVD.dll

Path C:\Program Files\Common Files\microsoft shared\A_v_DVD.dll
Size 606KB
SHA256 2a02e05cd302467c842648dffa050632411296d05438181ca49d171fc3376d16
MD5 76f31e3076d2db2115454e16fccaad7a
SHA1 a800a937887b6479880c31d1038e6e8526dcf218
SHA512 c8bceb03bf3a9eb171d163632ac9d30a8488f76cdd28ba1420aa2b13358b75bffab429080788368fc451905671635aa2fad9e695930e551c5f0b15b8f0661896
SSDEEP 3072:Qd8BnsXpsfHhNXFVbcb3LW4OrV34eH3Fe0RrTA9Io8585858584:QdSEWhZb/4OrOCeOZqqqq4
TLSH
T152D4D0252B68DAB9E0B6273ABCE69B4E6FE5F5090F33C30F624057B90E17F485519234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.exe

Path C:\Program Files\Common Files\microsoft shared\services.exe
Size 47.7MB
SHA256 250178556a4942bac4e800ffc50e7e4bccf830b0278cdef67945c2ffef29ab88
MD5 bcd13593bddcfbb52e72f11665ca15f6
SHA1 ee23de84423680f27c2920776a04ea089a23b33e
SHA512 4c23d0c23870c4e2641d8901bd236b43b9d1f679a7854ed009387df6c5ca259dc2d8d6696825fd6818b30a77898403e32483023689e8b009e34087e984fa3dc3
SSDEEP 12288:EJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJX:O
TLSH
T19FB743113708C675E8967B3AEDD3AB6D7BF0F9050E325307A2917ABA0D23F4578593A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe

Path C:\Users\Admin\AppData\Local\Temp\2323pp.exe_B28C516AA62F6488D6CA4179C8E4D52863D9213F.exe
Size 252KB
SHA256 2b5331308dfff885d62e3da03a32570b347ade8c4678214bab55af32f4167f2f
MD5 9b07dfe42e631f6fe905affe27b816a1
SHA1 6505ce70d718f2125a4eac57f9a4aca5137f99dd
SHA512 a61986926655e4d98916d904f301a5ff9c4d8ae7c633904705d2da3f4f162a637e78efb0e5e93af4a5e2e638ab018f951881d0fb9a51773b5d520d12bc78b5c2
SSDEEP 3072:+UoQIPcQxPOABfvJEWm43ULSYBbi6aJzAI6N8hZIiNBPVLLg+FR7K9qUwud1wkOE:+UNIPcmmmRm4EG76adSNc/B9XgGJ2FN
TLSH
T16444AE1237E0C477DA428436CDA62FB6FFF6E2244E16854357688E2CDF31ED1D52621A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-49-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/400-47-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/400-46-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1084-10-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/1084-24-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/1084-11-0x00000000005A0000-0x00000000005A2000-memory.dmp

Download

memory/1084-7-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4324-32-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4324-36-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5100-16-0x0000000000400000-0x0000000000441000-memory.dmp

Download