Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe
- Size 109KB
- Sample260925-26qqpayera
- SHA256 ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8
- MD5 eecb6a5602053aed85cbd897141ac3c3
- SHA1 4906d38ee7db784fbeffb72f1c869a76d57ab830
- SHA512 d94e8198a70ab4e57d15671edf78f3e0990e8e983560c6bcda0886874587756bfb7f8357589c64476a6d3eb9e6eb93d27c788b2ec935277f13457225c255114a
- SSDEEP 1536:qnzdDBObmNK4NU6wFsuimMwp5XTH+0+fMmIGTXvzl88LloQ6wb32:qnObmNK4BKsDm3nXiEmE8LloQ6wbm
- TLSH T18AB37D16EAAB80B3F2440070A85F5BA69F7D4C302E756C438F634E4D5E75583E525BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wowsystemcode\Parameters\ServiceDll = "C:\\Windows\\system32\\atlcom40_786.dll" jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe - Deletes itself 1 TTPs 1 IoCs
pid Process 4320 svchost.exe - Loads dropped DLL 1 IoCs
pid Process 4320 svchost.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\atlcom40_786.dll jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\syscheck jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe File created C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\svchost.exe svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe 4320 svchost.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4320 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ff71b30aceb6b661d112fd4421e819ec76e7f22bfc665002367c351cb9a805e8.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4688
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs1⤵PID:4920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\svchost.exe
- Size 22KB
- SHA256 7e58235fd2b03723ca1110956a09fff0089abcb133b1b18e64a939fe6ec8f1c6
- MD5 14dd16e7d2ee54c8db266a629eabf36e
- SHA1 cb0efeec1aa6b68665e25576b50e30efea19559a
- SHA512 a237e01841dbbe8415e1b11ca039101eb3550cbec603acbe5d4b0d21a478a96375f7c266c1703d50d7883ebf91abbaf1ec09e99b464d74e6d362989855a2ed7a
- SSDEEP 192:xive16aeax0uGDKYg49f/F7+jXGRuo2C56KgzKYLqrl1n0U2FLk1S4kH2+0Y6bVD:xdToEj+13vIK
- TLSH T19CA21307CB5BC256F64818B4A0AF57F2952C8900B936BD1B47A34D6CCEBA643F6613CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\SysWOW64\atlcom40_786.dll
- Size 100KB
- SHA256 46bfc2d960a87f5e8e98ce28162015a3b349f8441dbfa69d8e0797699eb14e02
- MD5 e1f7778217b4d70f00ec7945461820e0
- SHA1 8b71d67eeaa152e0f31d3aea414eb50ecfc935a2
- SHA512 761e79908002c0eb30e06c1c1855c242b6a01542acb638db250853f9f9c64c7fabf4d97ba4890b56aad6659fd28175ae3479087c76a5ac1a8a84c60e12a07e09
- SSDEEP 1536:JK4NU6wFsuimMwp5XTH+0+fMmIGTXvzl88LloQ6wb32:JK4BKsDm3nXiEmE8LloQ6wbm
- TLSH T1F0A36C16EAAB81B3F2480075B85F4BA29E7D4C213D756C038F630E5D5E76183E625BCB
- MD5 SHA1 SHA512 SSDEEP TLSH