Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe
- Size 162KB
- Sample260924-mnehdabe45
- SHA256 18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76
- MD5 8836ff89dac4f1da485005145ffa76f0
- SHA1 351e0cd025f0038a1ce5544b4e40a8abc7daece5
- SHA512 083c7cafb8fa97d5bce9244329dfde5c18f2e2dd4ae9f53f96800d14dc81703911fb103f63bac8f3dd1711074e77c51f536460e21f7af3166be653d576ca0d46
- SSDEEP 3072:mW9Z4WB5CzEYpfS5HpiMV2DVGX216H9+Mj:nwBvWHpjV+VD
- TLSH T1F9F37E63F2D089B1E1B20A78CC26C1C9993AFD246C38945A77E97E0E4D7D2C14D693D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001200000001c561-9.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 4112 svchost.exe - Loads dropped DLL 4 IoCs
pid Process 3368 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe 3368 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe 4112 svchost.exe 4112 svchost.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\G: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\H: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\O: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\P: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\Q: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\R: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\D: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\I: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\K: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\N: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\S: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\L: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\M: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\V: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\J: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File opened (read-only) \??\T: jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\OKFHBU.dll jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe File created C:\Windows\SysWOW64\OKFHBU.dll jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe -
resource yara_rule behavioral2/files/0x001200000001c561-9.dat upx - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Modifies registry class 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007 svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1007PV\EFile = "055036167053038190071081050032083125049065147075220065222213128206214087193249253037237130246241133050139" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\OKFHBU.dll" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1007PV\DFile = "055035169053038177089239050032094120066065174200119218166108150031099044218085234031150114121192059191203143148081140241058004233" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1007PV svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\ = "Maihook1007" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\Clsid\ = "{36429484-6478-41B2-A32B-FD0B4BBF04B2}" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile1007PV jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\Clsid\ = "{36429484-6478-41B2-A32B-FD0B4BBF04B2}" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ = "Maihook1007" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32\ThreadingModel = "Apartment" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2} jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ProgID jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ProgID\ = "OKFHBU.ShellExecuteHook1007" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32\ = "C:\\Windows\\SysWow64\\OKFHBU.dll" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\Clsid svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ProgID svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ProgID\ = "OKFHBU.ShellExecuteHook1007" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\ = "Maihook1007" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\ = "Maihook1007" jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OKFHBU.ShellExecuteHook1007\Clsid jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2} svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36429484-6478-41B2-A32B-FD0B4BBF04B2}\InprocServer32 svchost.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3368 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe 3368 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe 4112 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4112 svchost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3368 wrote to memory of 4112 3368 jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_18e38b99c63562f045678fc3141d6e44cb68513f78a7b9c38356ebb7bcd10e76.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4112
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\OKFHBU.dll
- Size 209KB
- SHA256 d040705a7c5c7b767e1f3f8dcb91076d23b945ce28cacf0ec8bd5923b652489c
- MD5 1365aff85f7d16745543b6b6681d21f1
- SHA1 32d2cf49a2b34629f889f100d45960983715bb9a
- SHA512 a7530d6127241dfed2597a71becc319cdd326522b486afc469b37a0ef60238906b09918f5adf0457542230502587b79aed343a20ac2722c8756f7caa1cd562dd
- SSDEEP 3072:cDVGX216H9+FW9Z4WB5CzEYpfS5HpiMV2DVGX216H9+Mj:AVDwwBvWHpjV+VD
- TLSH T1CE249E22F3E08975F1B20B78DC36C1C5593ABD25AC38955E36E5BE0E0D792824C683E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\svchost.exe
- Size 163KB
- SHA256 77f162f038374c8ce0976d64afb8bdabbdc8db855ea0daea18a1d2a52eae5701
- MD5 fc1c2ce11c3565b8b88be4a1c38c746d
- SHA1 1b96d5f97d0b5854e13c235f5bb5b2ae46d420ec
- SHA512 5531ffa23f404d73f28f801f40108c231efa8148803baa5e7076b94ddd64dc520be4a333a58aeca0038ec1c90e2de0df00bed697d1fa1b0e163e71baa44662be
- SSDEEP 3072:mW9Z4WB5CzEYpfS5HpiMV2DVGX216H9+Mj:nwBvWHpjV+VD
- TLSH T1B8F37E63F2D089B1E1B20A78CC26C1C9993AFD246C38945A77E97E0E4D7D2C14D693D7
- MD5 SHA1 SHA512 SSDEEP TLSH