Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 07:55
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe
- Size 799KB
- Sample260924-jsahfa1brf
- SHA256 a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c
- MD5 8c0bb5b2ee4da635bb0b7d4d9d281754
- SHA1 c500719406c4a6c2690c38d9bf5acdb597fe75a0
- SHA512 1bde2b578624b0d510e6e5344cc7e7f2859c273a3b49ee825cc29d6ad7a47cf05a35dd1846a453ed0d4036c83e05c2e16622cea4a89e4996bb0b90b9a1e1b0a5
- SSDEEP 12288:9hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbN0TLggl7w5KXwFGq:LRmJkcoQricOIQxiZY1WN0QCrup
- TLSH T12005B022B9C6C035C2B322B19E7EF76A9A3D7D360326C29727C43D355E705817B29762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe - Executes dropped EXE 4 IoCs
pid Process 2924 mplayer2.exe 3400 mplayer2.exe 4492 mplayer2.exe 4244 mplayer2.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe" mplayer2.exe - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/4312-0-0x0000000000400000-0x00000000004DE000-memory.dmp autoit_exe behavioral1/files/0x0007000000024334-18.dat autoit_exe behavioral1/memory/2924-26-0x0000000000400000-0x00000000004DE000-memory.dmp autoit_exe behavioral1/memory/4492-47-0x0000000000400000-0x00000000004DE000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4312 set thread context of 2932 4312 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 85 PID 2924 set thread context of 3400 2924 mplayer2.exe 89 PID 4492 set thread context of 4244 4492 mplayer2.exe 93 -
resource yara_rule behavioral1/memory/2932-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2932-10-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2932-12-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2932-29-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-41-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-43-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/4244-62-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-64-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-65-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-66-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3400-67-0x0000000000400000-0x0000000000435000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mplayer2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mplayer2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mplayer2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mplayer2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Download mplayer2.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" mplayer2.exe Set value (str) \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001" mplayer2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe 3400 mplayer2.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 3400 mplayer2.exe 4244 mplayer2.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4312 wrote to memory of 2932 4312 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 85 PID 4312 wrote to memory of 2932 4312 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 85 PID 4312 wrote to memory of 2932 4312 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 85 PID 2932 wrote to memory of 2924 2932 jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe 87 PID 2924 wrote to memory of 3400 2924 mplayer2.exe 89 PID 2924 wrote to memory of 3400 2924 mplayer2.exe 89 PID 2924 wrote to memory of 3400 2924 mplayer2.exe 89 PID 4492 wrote to memory of 4244 4492 mplayer2.exe 93 PID 4492 wrote to memory of 4244 4492 mplayer2.exe 93 PID 4492 wrote to memory of 4244 4492 mplayer2.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c.exe&2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\messengerplus\mplayer2.exe"C:\messengerplus\mplayer2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\messengerplus\mplayer2.exe&4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3400
-
-
-
-
C:\MessengerPlus\mplayer2.exeC:\MessengerPlus\mplayer2.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\MessengerPlus\mplayer2.exe&2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4244
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MessengerPlus\mplayer2.exe
- Size 799KB
- SHA256 a1d7b94cddab923a0c887d6d5fa2ce87e31f43961a6e1d9aaabd593871ee776c
- MD5 8c0bb5b2ee4da635bb0b7d4d9d281754
- SHA1 c500719406c4a6c2690c38d9bf5acdb597fe75a0
- SHA512 1bde2b578624b0d510e6e5344cc7e7f2859c273a3b49ee825cc29d6ad7a47cf05a35dd1846a453ed0d4036c83e05c2e16622cea4a89e4996bb0b90b9a1e1b0a5
- SSDEEP 12288:9hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcbN0TLggl7w5KXwFGq:LRmJkcoQricOIQxiZY1WN0QCrup
- TLSH T12005B022B9C6C035C2B322B19E7EF76A9A3D7D360326C29727C43D355E705817B29762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\aut51C5.tmp
- Size 66KB
- SHA256 b5eeb776c04b69eb392af40bcb4d07d3d3fc3758c6cdc54bf353e4b9a9351bb9
- MD5 cc48df2a9206d2cc318de78553b70319
- SHA1 3adbbeb090322bc1f7c462c473ddfd5dab65ba39
- SHA512 e1e02db38ec95be82ebd8da664ab7642c33cec8988ab49a3f7b8757eb7562b63f42e67fe4d9ac7060b9567fec57f011a6d4d30873fe0728c443f6280155bbafa
- SSDEEP 1536:uys1xxsZoPa8bhoxVizrAfyWSkk6CbEhhnlPc41d8aBcyXYiiySvs:juyTiNBRs/nlE4o8FX/iyJ
- TLSH T1916302E845D97737BE1B31B578BEC71023DA6F0D151AAC09A5A3CC01F81F78238E6659
- MD5 SHA1 SHA512 SSDEEP TLSH