77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe
Size 60KB
Sample260925-2ts1aa1wew
SHA256 77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5
MD5 6b6c5d1b02626a2db20e327bfcbefca6
SHA1 978e81596fffe4ee255886714ab70669d760d31f
SHA512 ad4df3e72b7f0b2ec966ab23b67fe8769fcd8ac94129bd033c3b17a4f9a88da9371fdd750f50c8f12967b02a4eec22c46a94c7338e2d934aca78158ce96aaa17
SSDEEP 768:aACl8gPr/Wki/VY0LLH92Y5cuKfBKPrbd7/lqZxSU+b:qr+/VYQEdYjbd7/lCStb
TLSH
T16353D08BD61458BBE349C1741F230B47A2767667663D858B4F868E4E6C342674E3322E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c554-3.dat	acprotect

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4912	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
4912	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winexe.dat	jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe
File created	C:\Windows\SysWOW64\5352622.ime	jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c554-3.dat	upx
behavioral2/memory/4912-5-0x0000000010000000-0x0000000010109000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\chekda.mod	jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4912	rundll32.exe
4912	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 4912	2836	jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" 5352622.ime,init C:\Users\Admin\AppData\Local\Temp\jaffacakes118_77207fdd3684503a5245531d7c70687fce98af66820cd9b672fd6df9ea6d52f5.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5352622.ime

Path C:\Windows\SysWOW64\5352622.ime
Size 29KB
SHA256 0f04828a6efc201ae6d847414ade49e46b5dd3dae9ddf4e9dd37fa6c15f0bd4b
MD5 c0f7dc8e6857335d7acfba7741745322
SHA1 45d5e437bb389f2e905b0981d6755bc193895d59
SHA512 dd199024554232c5c851b8017749eb4b354491b7d02d49e67edc8facec1578ea305043cb9e02865722b36ba69f2e9435d5f0dd6918d6db3b5a600c62573c4b3d
SSDEEP 384:PZuUIR8duxx30c8o/Wki/VRW0LLkc6OFKz/Y5dpQruKfBpwEIcV6pI+rcWmC:A8gPr/Wki/VY0LLH92Y5cuKfBKPrb
TLSH
T1A8D2E1C6511CA5AEF009E77D17134F9395763F2A923D83B753EAC71634346EA4E23222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winexe.dat

Path C:\Windows\SysWOW64\winexe.dat
Size 256B
SHA256 6f118c6609de3c30bf3c6ab847d59fd041deed8afb053f814dd95b07e6da3439
MD5 2e0c484115b47ffda8ee716753a4a829
SHA1 6fbb9b94e9f6a6c6f03e170c27d1bd9bfbf4a94a
SHA512 074a405f15afe4308c535b8a5c40672f841344c1a81cc58bb7f99317a866d600ab18196d3cf633ab0bfabea130b2c8555b2b6be8c6d8d3cde555b1a62f3d1d31
TLSH
T116D02BC2BECE5002D37327F8783433085BD2C49FB6533D2A08F48B158371A24064E6C0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4912-5-0x0000000010000000-0x0000000010109000-memory.dmp

Download