Analysis
- max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 09:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe
- Size 286KB
- Sample260924-ljfdfaae69
- SHA256 b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb
- MD5 3ff35b8a14d2cef2af74a0e0f8bd52af
- SHA1 0fc71b28fb14a78cde662fb9c60299063ed78d0e
- SHA512 a24596b9333df649b7669864e9fcbdcbee676f8550b206ae9edbbc9556bcd19bc7305fefc1375a05ff3947d938c4146c257c772de664fefd0d4d325609e4b14e
- SSDEEP 6144:GH6YajbofxCvTY9bfra20hVPuvV4CuLy05zTlryo5:GBWbY9bff0hVPuKCuG0FpX
- TLSH T1D3540151BBC548F7D0890B706C7E66369239FFA11F71218EE3986D683CB6681AD1C336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 6068 inst_BELGE.exe 3508 rinst.exe 2404 bpk.exe 1260 bpk.exe - Loads dropped DLL 3 IoCs
pid Process 2404 bpk.exe 5964 NOTEPAD.EXE 6068 inst_BELGE.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bpk = "C:\\Windows\\SysWOW64\\bpk.exe" bpk.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\pk.bin rinst.exe File created C:\Windows\SysWOW64\bpk.exe rinst.exe File created C:\Windows\SysWOW64\bpkhk.dll rinst.exe File created C:\Windows\SysWOW64\inst.dat rinst.exe File created C:\Windows\SysWOW64\rinst.exe rinst.exe File opened for modification C:\Windows\SysWOW64\pk.bin bpk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language inst_BELGE.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings rinst.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 5964 NOTEPAD.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2404 bpk.exe 2404 bpk.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 2404 bpk.exe 1260 bpk.exe 2404 bpk.exe 2404 bpk.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 6036 wrote to memory of 6068 6036 jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe 89 PID 6068 wrote to memory of 3508 6068 inst_BELGE.exe 90 PID 3508 wrote to memory of 5964 3508 rinst.exe 91 PID 3508 wrote to memory of 2404 3508 rinst.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b475a5b6658b0848cd0992f424d9e348b68a19cda056ef28631beedef2ba14fb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\inst_BELGE.exe"C:\Users\Admin\AppData\Local\Temp\inst_BELGE.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\RarSFX0\BELGE.txt4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:5964
-
-
C:\Windows\SysWOW64\bpk.exeC:\Windows\system32\bpk.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2404
-
-
-
-
C:\Windows\SysWOW64\bpk.exeC:\Windows\SysWOW64\bpk.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BELGE.txt
- Size 30B
- SHA256 df8c6d55fa31b607825b3aa070a9119cb128ba3712c1c93a9182fad63a6ccf90
- MD5 4280e8d9f712149432dd2f157f13cf77
- SHA1 cb1229c3c30c130f6aa35bd94feb39b7f60ea111
- SHA512 cefe3e168b6df9dc000ea3c20d91f8c9f1adf1df5d040710403b841bb38977a1fbdc3c2b2a2693522d246b1ccb97d7ef352fa4d1a83bfc205e500ce35117f344
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpk.exe
- Size 408KB
- SHA256 ac6475ccd1e8f6e6870f855fcf0855cbaeb29a4bcc2ab7a575f36953e5de41e1
- MD5 a12cb0accaac5070317d3d61fc210cc5
- SHA1 17c007051da00853a4f3a3e1013a176602fa7778
- SHA512 300bfd5c8e230e5cdd98ea7e0df8cc703f4c04410d621f0f2c8ed8ac8dc987436ad254bf182258a791a4e533253629da579a9e49cd7e975f65941dc60654975e
- SSDEEP 12288:YMrzo48iU7tSA791vbMI7WCtcFCnAD2Y4+1uM:X/oDiZA7v9VtcFCQ
- TLSH T102945AE40DF272DAB382CA12E718392843E275320F429E7E5E21D7E5AD4A793531F15E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bpkhk.dll
- Size 21KB
- SHA256 f445ae835e42ee5afe459ccd6ff9a2650c1ec334403dcb52f88fc3ce124406e5
- MD5 b852c0879652c88fa53e8dbbd6c281be
- SHA1 1de72e8b3a9a358868c9bf7010cbada3496e2173
- SHA512 c202749be8c8abe93976e62a93ba8dd3219c238fa4b1d4febfa0f1f0d50b1b319bd00407efad1a226f24da11c9a6962c9d8b4a3edc86ab80d8fcdd78fcfb9ec1
- SSDEEP 384:zQy6MiZQBJTJQyprbhQqCsRZXzK8BzhXqu5lOsXLRSYcYOT5iAcqr8tU6D7:kzM6QayNZjKozvEsFSYw0U63
- TLSH T1E3A2F9E43C8131E792C3E9815C5D0A2CB6C22573965768D4CE61FA9D5E6F2C38B2C8ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
- Size 1KB
- SHA256 f46d01869b0719b6e1a174f88f9e8aaa66a8d689a9cdb9ba74e5cba9eac40ecd
- MD5 5624fed86d09d0882a8e3a41c60626c7
- SHA1 1b88eca5545b7ca054e6dbb4665ad134f258b55f
- SHA512 bea394116bcc27e519ce6e29ffe201bcfbe8d28c4edbe45ab751e6ef56fd915c97e0668e1ce33663d241fae6e34fdfa82263107ec6495d43955fa7f3a8fb4578
- TLSH T10E21EC522AEB0316E5B3A970BCF0C4650C683D74F935C75C91405C1D0813298AC60F12
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
- Size 7KB
- SHA256 93b1dd588886623a06f2aa8aa19aa19dd138c73ef5924747a9f8ff062d16e2b0
- MD5 8557f32cb5872447b64c3d6bd6dd9879
- SHA1 489e6e2433c24c49615423391bb8c0d36d3692ba
- SHA512 365b05dfd891636dd0efa9d9da153ad77db241b8695462494a80f75fc29789263e136734a83f55439f50e43b52af225f34309a1acab194edfd78474f6e8a4f97
- SSDEEP 12:imQiJUiuhSoy6bTYbHzn48CImkV7qh1wYGXyXliLp/:1Qi6iQSoMTTp6wY4p/
- TLSH T146F18215B7D55D01A92FA8028D935E702197816530CBB6F63A9E4619680647B4CF4B8C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
- Size 22KB
- SHA256 98d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
- MD5 9a00d512f9e1464ad793702cf2b1eda0
- SHA1 39a47a90cd3dd132dbab9f5052dda38dbd7c63f6
- SHA512 18604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba
- SSDEEP 384:c3PqIGR1uEtfWlXdbvoht0zsQHmr246v1hLqsHWuTqvhwp:aqZv3tfEbgIzsQHs6v1hLqQ9q
- TLSH T15FA2A4563FE70735F3B3CB306574EB12896AB9A2E853CB4DC4D21F090523A5699F0E26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\inst_BELGE.exe
- Size 270KB
- SHA256 781f4711dbef03904af17c4cd9a5ceae117bd94404bdc978cf13a88f18513fc9
- MD5 a8f4483e929e74a7de0e40a38f718b97
- SHA1 d9535e7629c4970cb791f6a9189518a74d9c17b9
- SHA512 e03b127b94b9535d0233e55cd7494f475ea6804f12f98fda0594d57dd5374bc653f9654b7eb9aaa52da992c29b3678fcf064a1535f67345b3afd5a4a48384269
- SSDEEP 6144:d6YajbofxCvTY9bfra20hVPuvV4CuLy05zTlryo5f:rWbY9bff0hVPuKCuG0FpXf
- TLSH T106440114B7C948F7D08A0B306C7E667A9238FF915B71318ED3986D293CB6582E81D379
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bpk.exe
- Size 408KB
- SHA256 cd06f57e2e2956c634f851eb92666e9e24557fffbfcd098686e3d7fe03d8ffed
- MD5 a635bc1492e4c39ef47ed617d3dfe491
- SHA1 353ae5d543aee4bd2084798308a82361336b34fb
- SHA512 e152eaaebc4a6a48d32ed2382e048f171d35200d1654cfb241f57612b655e921b8645e700f011d3638fda4bbc7f50e90ebdc24398664a9e553540b15a006b226
- SSDEEP 12288:IIsNvzk/CGbZIuTqJxRGRtjNX0zKt8+rwnb:IIsNvz2CuTWGRt53tw
- TLSH T11E945C017BFB4826E5B21A31DAB617B2B9F9BB624C37CE0B5340997CD931E11DA10B35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bpkhk.dll
- Size 21KB
- SHA256 0ee6154256e55de7d451e729c590f5bbf65479503099c3dfeaa10deac6fe4901
- MD5 a11068817ba83d7b8c61a5c53c5a72ab
- SHA1 cf4685ae095d5b1e92062c9d299cf9d250b6bab2
- SHA512 a5ef2ec37eaf688c1fa926349227d25de1c5568c5630e56f8e5e3104ae6ee45275de8599d33d164cd2fc7c5b5dd853433e4228ff553d83228ae3f925446e9bae
- SSDEEP 384:Hm3aDEM3BjSZiAtu3Zq5iwd+6I4rt64E53K:+aQMAZiKupmiB4rt
- TLSH T1B6A24BE1675416F1E5782C3031ABAE3B123EE77505609997CAA7EC744D32289BE38353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\pk.bin
- Size 7KB
- SHA256 19b89ee2c2c77bed08859934460e19daa810660f7bfedcfa1b09c95fcbe432da
- MD5 98fbb00d8657e10653d15b156791d1bd
- SHA1 f69a4adcb8729ef11a3176439c3413476d5519c8
- SHA512 9bd4fba5fa2edf2fa2dcf8df7a6580722142cf6ddbf81ff670fa0ba61fcc465899e2ba61353223214fb4a87b77a8fcb9eef273a0a44c85d26da812abd9e8fe34
- SSDEEP 12:ZGgCiG2hmHzopjGSfPKEhWqgnD1khZ+YSH2x3:ZFGUEopjf32tD13YtB
- TLSH T1BCF182AE9425F923FE4029E970215890F04C8F44715BAAB1D6548449C447A937FCEEA2
- MD5 SHA1 SHA512 SSDEEP TLSH