d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
Size 213KB
Sample260925-2mfrdayy7k
SHA256 d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2
MD5 8c8f92582f2d55a78a66e8f998c9cd9b
SHA1 d319a37532609f9fb99242145552e7d8b831bd80
SHA512 50493a168d889a25a45d0432e971c657faa471d459ea7ec713f7c9f41bca2c37c8bbc66bfca80342a7deaefac758ca3044741fb5e30304c65498acf307e2ae49
SSDEEP 3072:iEpTzDqZqje6pVtlCia5NZVYLZhpm0JJB1aLo:iEVsQTBiVYL9m0vB1F
TLSH
T13D24E35D4104FC2CC3785D33A870ACFBE717ADA5E5E238C7ADD0BC756534A912AAC868
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery vmprotect

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2016	panzerfive.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000c00000001c621-8.dat	vmprotect

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ppastream.dat	panzerfive.exe
File created	C:\Windows\TestDll.dll	panzerfive.exe
File created	C:\Windows\ppastream.dat	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
File created	C:\Windows\lpkreal.dll	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
File created	C:\Windows\lpk.dll	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
File created	C:\Windows\lpkbackup.dll	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	panzerfive.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1768	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2016	panzerfive.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2016	1768	jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d808650b019aa15fa4215fd621a1a206a24339ddb788e260b889ab39d3b7b1f2.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\panzerfive.exe
  C:\Windows\panzerfive.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TestDll.dll

Path C:\Windows\TestDll.dll
Size 141KB
SHA256 42d4c23c7e168a8c63b7b2116a257eedb256c4f365c3d616045030be2bf2ad1b
MD5 1ef8228f8c4c046c5af084b0f17d4966
SHA1 dda7a18b20b42aec7450d73cbb758ab045cac0fd
SHA512 da96111f61e3720dc6528b37d33d20ba6795356b292a73ffded89165d23667c16f9a9282faac3f14344a3b4f666a6685f33138dbe57e68db8017f4f423ee3a6f
SSDEEP 1536:ZLZuUlRfLo6tIffrZf0F8KWPkgmKU7LmhQ8yjSE1Kz55vn4:ZLQUlFLBKffrB0SrLmK0pjS9nvn
TLSH
T1D6E317424901FCB1D47715F020B6AEF7EA395D8283ED71CBCF25FEA15C722616A2934A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppastream.dat

Path C:\Windows\ppastream.dat
Size 129B
SHA256 b16707131a21eb9c17f718f159e8f86b529ba332fc6a9cfa9502bf503c2d85e7
MD5 91f16f46982b3db2b2bf7ddd26b81884
SHA1 992ea815d8656bb436230af99bc23ebe2cef169a
SHA512 c92ea367dfdaf53e7bbf46a828cb6933e587feb47ea4595ba6989035c5a2485f190c8568b944a4e42f10ee30db280c2934680567ccf2e7d56920e904196a901d
TLSH
T165B09B701EB4563B50799A4505D3444A83756553957464AFC94444B3549C91185F7A0D
MD5 SHA1 SHA512 TLSH