Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 10:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe
- Size 159KB
- Sample260924-mqa8qsbe93
- SHA256 656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9
- MD5 eaa19fe14a8ca0c7ae2cdb2fe2273ba3
- SHA1 d277021abf64895e7ca6e067606d837f96db886a
- SHA512 d17f7cb33884e7f863819f0ec06ecb0d4f4a21361ef559c6058250ac8f4639634d452ee353c1467a0782dee86d7c4083321dbe5b0aea2621b238dab3d9562ca8
- SSDEEP 1536:aBwqlEEpwlDTgnr+TYXWbYa/y/m3+/6kvDxnfwR2UYIVGXTL29H6T4W+mUBPwVAv:aPUJQVGUarevDxnfwRpDVGX216h+Ij0
- TLSH T190F37B22F6E08471E1B11E788C27C5CA653ABD367C38545AB2E9BF0E1D79283981D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e00000001c4ff-5.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 3448 wininit.exe - Loads dropped DLL 4 IoCs
pid Process 1276 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe 1276 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe 3448 wininit.exe 3448 wininit.exe - Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\I: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\J: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\O: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\Q: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\S: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\L: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\M: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\R: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\U: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\V: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\H: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\N: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\D: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\K: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\P: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened (read-only) \??\T: jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ZVWS.dll jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe File opened for modification C:\Windows\SysWOW64\ZVWS.dll jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe -
resource yara_rule behavioral2/files/0x000e00000001c4ff-5.dat upx behavioral2/memory/1276-9-0x0000000002350000-0x0000000002370000-memory.dmp upx behavioral2/memory/1276-8-0x0000000002350000-0x0000000002370000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32\ = "C:\\Windows\\SysWow64\\ZVWS.dll" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ProgID\ = "ZVWS.ShellExecuteHook1007" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ = "Maihook1007" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ProgID\ = "ZVWS.ShellExecuteHook1007" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJWorkFile1007PV wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83} wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32 wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32\ThreadingModel = "Apartment" wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007 wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JJWorkFile1007PV jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\ = "Maihook1007" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JJWorkFile1007PV\DFile = "054034166053038184089028050032087112025065240059125182249102195032204189206240212110145066203182115208194128136168201056014" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ = "Maihook1007" wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\Clsid wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\Clsid\ = "{8BAA7594-70F6-4895-BA1C-778C33327E83}" wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ProgID wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JJWorkFile1007PV\EFile = "054033163053039191075129050033094100132065029078059011203075029241050148231090215068008016180153187063069189" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83} jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\Clsid\ = "{8BAA7594-70F6-4895-BA1C-778C33327E83}" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\ProgID jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\ = "Maihook1007" wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BAA7594-70F6-4895-BA1C-778C33327E83}\InprocServer32\ = "C:\\Windows\\SysWow64\\ZVWS.dll" jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZVWS.ShellExecuteHook1007\Clsid jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1276 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe 1276 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3448 wininit.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1276 wrote to memory of 3448 1276 jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_656939d17cab3b45676fc3768a1869e9db00585b717595c2ad8e9915fcacb3b9.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\PerfLogs\wininit.exeC:\PerfLogs\wininit.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:3448
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PerfLogs\wininit.exe
- Size 159KB
- SHA256 22cc151fe0de4a0d8d33e839433b199d3c3709bf95e082365f121b38cd86a0c2
- MD5 aa65aa0ae2fdfb3de4b67e54674e3f37
- SHA1 517f95a3700250e0c87b3b9cfd176b274ea9c9f7
- SHA512 b29aad7df5e665326942ddca6f1a1b68f6d69d7aedf403293cf839a5445b3e6a09f646bf5bd899d58cc7c4b7f1fc962f07777e1c461bf83f4db99ef5714f32de
- SSDEEP 1536:aBwqlEEpwlDTgnr+TYXWbYa/y/m3+/6kvDxnfwR2UYIVGXTL29H6T4W+mUBPwVAC:aPUJQVGUarevDxnfwRpDVGX216h+Ij
- TLSH T16EF37B22F6E08471E1B11E788C27C5CA653ABD367C38545AB2E9BF0E1D79283981D3D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ZVWS.dll
- Size 206KB
- SHA256 0b79481acf591feffb81d8e91e0fc866948a9cdc3b0c5d7e2bd0ce183de56463
- MD5 c1a6d42c228acc97039f040773ca860e
- SHA1 1eac2deec3c07fcecd9389e6c10184910d7a6667
- SHA512 edfc0f6cce846f81d11516ccac08170b1cacadb173f0398eecf4d0d2672c123f688eaa72de5d53f2f2f0be950af7ad620fd85746af23eb5e7ce90a12a88c7686
- SSDEEP 3072:PDVGX216h+DPUJQVGUarevDxnfwRpDVGX216h+Ij0:rVDTpG1evmRVDZ
- TLSH T1A3248C22F7E08471F1B21E788C27C5D55A3ABC26BC34455AB2D5BF0E1D7A28398193E7
- MD5 SHA1 SHA512 SSDEEP TLSH