a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
Size 184KB
Sample260924-jca42a1wfz
SHA256 a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17
MD5 11a06cd3896b399c0bdd74bb484512d1
SHA1 61f9ce08811b7ffa93b466eefb173f9ce8a0daf3
SHA512 26e3e91b3cfea12323ad3de072d3fd006294a2858354030b0f732792c8277aeda6add759460b93fcf5b263fece75b8dbf02a42e09cad6ccd62493933a3b63a40
SSDEEP 3072:KQO+1p+mRFrQGyd/vvvYAnd4sA7I54fXlZB:KlU+mDl8/PYKUcWP
TLSH
T1AE045B117EA184B1C37D4434999A67BAD2E69D705EF20803DF523FAC6E31C87C62AF16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4688	regsvr32.exe
2752	rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ypbg1.dll	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
File created	C:\Windows\SysWOW64\dllcache\ypbg1.dll	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
File created	C:\Windows\SysWOW64\ypbgv.dll	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 46 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ = "ATlMy Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID\ = "TestAtl.ATlMy"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\ = "testAtl 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ypbgv.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR\ = "C:\\Windows\\System32"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1\ = "ATlMy Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1\CLSID\ = "{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ = "C:\\Windows\\SysWow64\\ypbgv.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\ = "ATlMy Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer\ = "TestAtl.ATlMy.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CLSID\ = "{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID\ = "TestAtl.ATlMy.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe
2752	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4688	2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe	89
PID 2264 wrote to memory of 2752	2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe	90
PID 2264 wrote to memory of 2416	2264	jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a21cf0577ec6e2dac2d2dd4548291decb18f589aec1299f9d562537224313f17.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Windows\System32\ypbgv.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4688
- C:\Windows\SysWOW64\rundll32.exe
  rundll32 ypbg1.dll , InstallMyDll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 375O540.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

375O540.bat

Path C:\Users\Admin\AppData\Local\Temp\375O540.bat
Size 2KB
SHA256 5b28b8d39eafcf6ee66721394def392c89648c6e82ad8cf558a478e713ff391c
MD5 b256fd85915d71c6e7b1f82b9b2174af
SHA1 c3a03d297e021180751d65ad61ff26e9d7b4a387
SHA512 0b94cd7609c3d25fedfb96997d256af26a9c583842a1f92d0d305cea055040b9621665c3d967cda38f3f0d19fe64b821f0b272560b9ab6037359a2ad07dfdff7
TLSH
T1F841480FE271AC0ECF887CB699EC0126E01DF8AA0A6B2D280A83806685E1CC4544FF03
MD5 SHA1 SHA512 TLSH

Submit Download

575.aqq

Path C:\Users\Admin\AppData\Local\Temp\575.aqq
Size 90B
SHA256 df30afae31f91d9dca57f734cbb6442d1af1ca510a13555fb0cb505a43011cbe
MD5 55f0373deac4b90c75e5540771a8a174
SHA1 dbc9731b0070d54e94299e5dafadf33a0a3a7e71
SHA512 91e4386452c7e66405a9c65608be431e4d45fcc23e9323c2644414bd0a5f3b87e16f289e45bce538587f938b16fc7f3767b6f9a4ad795ea03c62f39a3bd1454c
MD5 SHA1 SHA512

Submit Download

ypbg1.dll

Path C:\Windows\SysWOW64\ypbg1.dll
Size 108KB
SHA256 3f659814f61540fe83791196353973d2bb4173209afbdd9af8b4debd7c1a1231
MD5 e12b92bb1be092e7ef08c610d02dd12f
SHA1 812f6b79d0f1155ce5ab331f6345487e3f085c5f
SHA512 05fd8b6ad0ee1b14e708382231da7710bb3e61d6fd334e6f1b850eff3a030a98466f7fe518d03455a805c182a7e8a4c7d9f48a2668239485612c85fb10d6135a
SSDEEP 1536:CL6yB//eqHfvc0ru4wyNnd69sA7I5yi+fXlZ:CGyd/vvvYAnd4sA7I54fXlZ
TLSH
T1E3B34A117DA184B1C37D8434D58AA77AD1E68171ADE208039F631FFCAE30D87D62AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ypbgv.dll

Path C:\Windows\SysWOW64\ypbgv.dll
Size 44KB
SHA256 1cbf403e5ebe1db9d14f29b3de5ada770a4e0843570b2f8c005181597a062f32
MD5 9cde32e83f72c08a648d4eaff0c67c8e
SHA1 162b8687134e506b3e51f7d3868edd3ba5a5fc4b
SHA512 ce9d4a482564aad6fb4adb86a4b53030040c3fe0a5add5e267c79d54359edeb7d6506c16af1082b339dff13736843c91307076cab10988193ddfae7476a3ba6b
SSDEEP 384:OQKY6SDyPpoJxlqpOy3lbfBlyBWlUrRskmAr:/LyPwlXOlbfBl0WlmRiAr
TLSH
T13E1319053BD486F6C3AD01707C674BB993A6BCA04FE14483EF61379F2E3A596C62531A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download