Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe
- Size 116KB
- Sample260925-2xr76aydpb
- SHA256 27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af
- MD5 73af7b488675f39f0ddca3893620f71c
- SHA1 85090ee0af53e54244c403dfffb435b152cd464e
- SHA512 6337b07a5637ff067a8ad1b895919811a684bd13118ca2695ae829bfa5aa2aec4cfadb089ad14de7a1e14db45f7d72f55e022fae6e7ef6af50cce7f66257957a
- SSDEEP 1536:XV0uz/oH+d3OTBYQAXyjbF7nZm7A1CUPVMS1tz0rnk:P/X+TBYQACjJ0EL
- TLSH T1C3C3BE6EF95C0773EDC44536047EFB2A86BA2C251866F8D2AF5833906CF25E0913537A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x001b00000000696b-17.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 3592 winweng.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system\\winweng.exe" winweng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system\\winweng.exe" jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe -
resource yara_rule behavioral2/files/0x001b00000000696b-17.dat upx - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\system\Lins.log winweng.exe File opened for modification C:\Windows\system\winpingying.ime jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File created C:\Windows\system\Lins.log jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File opened for modification C:\Windows\system\Lcomres.dat winweng.exe File opened for modification C:\Windows\system\winweng.exe winweng.exe File created C:\Windows\system\winweng.exe winweng.exe File created C:\Windows\system\winpingying.ime jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File opened for modification C:\Windows\system\Lcomres.dat jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File opened for modification C:\Windows\system\winweng.exe jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File created C:\Windows\system\winpingying.ime winweng.exe File created C:\Windows\system\Lcomres.dat winweng.exe File created C:\Windows\system\Lcomres.dat jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File opened for modification C:\Windows\system\Lins.log jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File created C:\Windows\system\winweng.exe jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe File opened for modification C:\Windows\system\winpingying.ime winweng.exe File opened for modification C:\Windows\system\Lins.log winweng.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4964 cmd.exe 5616 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winweng.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe 3592 winweng.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe Token: SeDebugPrivilege 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe Token: SeDebugPrivilege 3592 winweng.exe Token: SeDebugPrivilege 3592 winweng.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1192 wrote to memory of 4964 1192 jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe 88 PID 3592 wrote to memory of 5616 3592 winweng.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dele59a658.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4964
-
-
C:\Windows\system\winweng.exeC:\Windows\system\winweng.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dele59aadc.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5616
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dele59a658.bat
- Size 335B
- SHA256 1fdf51fb26d202afd2f37406ea2b85521a3d765f30b8e9d31e4702f4bb08f6f2
- MD5 60ae41aebd2951d136afc59d94fc183a
- SHA1 ead300390bad12ce323818bfdc3b4311c63b4178
- SHA512 d1f12f42948c89108d695e48b6a2cc58ad2b46117aba0e9918c41a8c51722a221dc417d8a8a8c0896dd2cd636a74fd8e37acd7452cc3cedd4398267ebf4df206
- TLSH T10BE0205151B54F771856A3174832524EB0304F585F9F3F0D35F8C58C325245DB8C3257
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dele59aadc.bat
- Size 161B
- SHA256 e908b33daedcc11100bc3c18a65945c98cf4a7768f49d8a087e149c8f3b4b722
- MD5 e209c600b8efff84bde1d441c2d475f7
- SHA1 c045271e042d1fa42ec26608241ea7c72689e130
- SHA512 cfe9ca3e07fbe0537e421b34a2e158a9deab32b716301adb1bd8584746b36ad096e447989cfce0882764e53cce368f6ee4b2413690764c193def0f11a5fce8a0
- TLSH T1F3C08C210530865388E4266A015A410F063AF0F93B1E5D2536840006F00202F6DFB7B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System\winweng.exe
- Size 116KB
- SHA256 27c073fa3686292ae4eca3918ffbe8e91a849409ee3daf73b8cbb252145245af
- MD5 73af7b488675f39f0ddca3893620f71c
- SHA1 85090ee0af53e54244c403dfffb435b152cd464e
- SHA512 6337b07a5637ff067a8ad1b895919811a684bd13118ca2695ae829bfa5aa2aec4cfadb089ad14de7a1e14db45f7d72f55e022fae6e7ef6af50cce7f66257957a
- SSDEEP 1536:XV0uz/oH+d3OTBYQAXyjbF7nZm7A1CUPVMS1tz0rnk:P/X+TBYQACjJ0EL
- TLSH T1C3C3BE6EF95C0773EDC44536047EFB2A86BA2C251866F8D2AF5833906CF25E0913537A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system\Lcomres.dat
- Size 5KB
- SHA256 2d907e63fe3973408af5e5890ab2134a24685e8b41fdcf7c00d258b3c18c8a0f
- MD5 7d331c4c9d4394458ec36d6695e717b9
- SHA1 7ab1b1015c20e738c1b264518d4c56816b14a024
- SHA512 4ab0b17d33161f05ea34da2a5fc8cbf84039b2746e0ce4901756c3d95d07b6a151777823704b43daaaedd0f9b972a6b866f2ba57b7b056f5dfc69d90efd5d597
- SSDEEP 96:jnTZGzn7+rM99JhT+R6foMYW/erbBGCOEPlmFoFN2:jnTZ4nsAvV+RRMgx7VykN2
- TLSH T171C1531DF82C30F1EA4282455609AFA1467F74B0CE64B51F5FC5EBD1E03090EB0E597A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system\Lins.log
- Size 116KB
- SHA256 9ee3e7fd907b1ff256fff080feab004b3103a7ec40726fbca0e249791af9c6bd
- MD5 2ba3796976c17452e123803bfac85602
- SHA1 d8426eeb174052afd7f27c6a2fdfd3ad6cd5a885
- SHA512 ad2ba9323aea2243ab50cc65a9ea47fc9efa0244aded4236af9b07179c7986d1dc2d0543b1b6bb24729ac9dcf682de5500a4496ae6f7afbe1487cd0481b824dc
- SSDEEP 1536:xV0uz/oH+d3OTBYQAXyjbF7nZm7A1CUPVMS1tz0rnk:B/X+TBYQACjJ0EL
- TLSH T1C3C3BE6EF95C0773EDC44536047EFB2A86BA2C251866F8D2AF5833906CF25E0913537A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system\winpingying.ime
- Size 46KB
- SHA256 bd420880520b0b199e3c58306b925c4c7dc9fbcd44750cfea21c93a46956d262
- MD5 5491438f8a69190c99bb1a451cf067f7
- SHA1 c82f04909b56c2c5a7328e59677d441848994e1a
- SHA512 f64e521ffe56518169b76e57a0d2fd6b548382929621816b160a0764d35c4bb99488f7b5f7b85fe2941311a417ba5fef00ac21cbbc049cadd3e19e7cf34f5f33
- SSDEEP 768:kXWDzZTgzpajjq8XhP6O0alS6kFZ7ETedXzH6FHXgJd1eIxb04ySMQCTyCGjrklj:kGDFTX3Xtv0alzkFZXrJd1eIxb047MQa
- TLSH T15123E1A11298CBD1C8DA5379575C9F87BFDB402224D9A492320DB256E4FE338F172B4A
- MD5 SHA1 SHA512 SSDEEP TLSH