3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
Size 60KB
Sample260925-w2pd6sgf73
SHA256 3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd
MD5 f81892b43349b4ba904b0f8bc799a129
SHA1 85adabc470b2873cd7b3438f9e69438ba378aca1
SHA512 3d472dd7fdd8b01efebec386a2fa310b442aec2caff966c6ad87048207a4debde0b0d9e3e1fb8c9432ae693ee0a7e9856d6a8d37c4122c46234bc4571aa70f40
SSDEEP 768:20t8GBj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:qyjjWYIgMOdb4U68fa
TLSH
T1E5536D562B4680F2D2EE0674706D2F375FBF98342D549493CF735ADA1D7988BE82830A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5136	msioSvr64.exe
764	bbbbbb.exe
576	hhhhhh.exe
984	oooooo.exe
5792	aaaaaa.exe
5668	cccccc.exe
5068	yyyyyy.exe
2960	ffffff.exe
3788	mmmmmm.exe
2888	dddddd.exe
4720	pppppp.exe
6068	rrrrrr.exe

Loads dropped DLL 13 IoCs

pid	Process
4876	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
5136	msioSvr64.exe
764	bbbbbb.exe
576	hhhhhh.exe
984	oooooo.exe
5792	aaaaaa.exe
5668	cccccc.exe
5068	yyyyyy.exe
2960	ffffff.exe
3788	mmmmmm.exe
2888	dddddd.exe
4720	pppppp.exe
6068	rrrrrr.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\bbbbbb.exe"	msioSvr64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\oooooo.exe"	hhhhhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\aaaaaa.exe"	oooooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\cccccc.exe"	aaaaaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\ffffff.exe"	yyyyyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\mmmmmm.exe"	ffffff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\rrrrrr.exe"	pppppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\hhhhhh.exe"	bbbbbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\yyyyyy.exe"	cccccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\dddddd.exe"	mmmmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\pppppp.exe"	dddddd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\dddddd.exe"	rrrrrr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msioSvr64 = "C:\\Windows\\msioSvr64.exe"	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msioSvr64.dll	mmmmmm.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	dddddd.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	pppppp.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	rrrrrr.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	hhhhhh.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	oooooo.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	aaaaaa.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	cccccc.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	yyyyyy.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	ffffff.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	msioSvr64.exe
File created	C:\Windows\SysWOW64\msioSvr64.dll	bbbbbb.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\msioSvr64.exe	aaaaaa.exe
File created	C:\Windows\cccccc.exe	aaaaaa.exe
File created	C:\Windows\msioSvr64.exe	mmmmmm.exe
File created	C:\Windows\msioSvr64.exe	oooooo.exe
File created	C:\Windows\msioSvr64.exe	pppppp.exe
File created	C:\Windows\rrrrrr.exe	pppppp.exe
File created	C:\Windows\msioSvr64.exe	bbbbbb.exe
File created	C:\Windows\hhhhhh.exe	bbbbbb.exe
File created	C:\Windows\msioSvr64.exe	hhhhhh.exe
File created	C:\Windows\aaaaaa.exe	oooooo.exe
File created	C:\Windows\yyyyyy.exe	cccccc.exe
File created	C:\Windows\msioSvr64.exe	yyyyyy.exe
File created	C:\Windows\ffffff.exe	yyyyyy.exe
File created	C:\Windows\msioSvr64.exe	dddddd.exe
File created	C:\Windows\msioSvr64.exe	msioSvr64.exe
File created	C:\Windows\msioSvr64.exe	cccccc.exe
File created	C:\Windows\msioSvr64.exe	ffffff.exe
File created	C:\Windows\mmmmmm.exe	ffffff.exe
File created	C:\Windows\dddddd.exe	mmmmmm.exe
File created	C:\Windows\pppppp.exe	dddddd.exe
File created	C:\Windows\msioSvr64.exe	rrrrrr.exe
File created	C:\Windows\dddddd.exe	rrrrrr.exe
File created	C:\Windows\msioSvr64.exe	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
File created	C:\Windows\bbbbbb.exe	msioSvr64.exe
File created	C:\Windows\oooooo.exe	hhhhhh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhhhhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaaaaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cccccc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyyyyy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmmmmm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dddddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rrrrrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msioSvr64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbbbbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oooooo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffffff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pppppp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4876	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
4876	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
5136	msioSvr64.exe
5136	msioSvr64.exe
764	bbbbbb.exe
764	bbbbbb.exe
576	hhhhhh.exe
576	hhhhhh.exe
984	oooooo.exe
984	oooooo.exe
5792	aaaaaa.exe
5792	aaaaaa.exe
5668	cccccc.exe
5668	cccccc.exe
5068	yyyyyy.exe
5068	yyyyyy.exe
2960	ffffff.exe
2960	ffffff.exe
3788	mmmmmm.exe
3788	mmmmmm.exe
2888	dddddd.exe
2888	dddddd.exe
4720	pppppp.exe
4720	pppppp.exe
6068	rrrrrr.exe
6068	rrrrrr.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4876	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
5136	msioSvr64.exe
764	bbbbbb.exe
576	hhhhhh.exe
984	oooooo.exe
5792	aaaaaa.exe
5668	cccccc.exe
5068	yyyyyy.exe
2960	ffffff.exe
3788	mmmmmm.exe
2888	dddddd.exe
4720	pppppp.exe
6068	rrrrrr.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2620	4876	jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe	80
PID 5136 wrote to memory of 2620	5136	msioSvr64.exe	80
PID 764 wrote to memory of 2620	764	bbbbbb.exe	80
PID 576 wrote to memory of 2620	576	hhhhhh.exe	80
PID 984 wrote to memory of 2620	984	oooooo.exe	80
PID 5792 wrote to memory of 2620	5792	aaaaaa.exe	80
PID 5668 wrote to memory of 2620	5668	cccccc.exe	80
PID 5068 wrote to memory of 2620	5068	yyyyyy.exe	80
PID 2960 wrote to memory of 2620	2960	ffffff.exe	80
PID 3788 wrote to memory of 2620	3788	mmmmmm.exe	80
PID 2888 wrote to memory of 2620	2888	dddddd.exe	80
PID 4720 wrote to memory of 2620	4720	pppppp.exe	80
PID 6068 wrote to memory of 2620	6068	rrrrrr.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2620
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4876

C:\Windows\msioSvr64.exe
C:\Windows\msioSvr64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136

C:\Windows\bbbbbb.exe
C:\Windows\bbbbbb.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\hhhhhh.exe
C:\Windows\hhhhhh.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\oooooo.exe
C:\Windows\oooooo.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\aaaaaa.exe
C:\Windows\aaaaaa.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792

C:\Windows\cccccc.exe
C:\Windows\cccccc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5668

C:\Windows\yyyyyy.exe
C:\Windows\yyyyyy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068

C:\Windows\ffffff.exe
C:\Windows\ffffff.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960

C:\Windows\mmmmmm.exe
C:\Windows\mmmmmm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788

C:\Windows\dddddd.exe
C:\Windows\dddddd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\pppppp.exe
C:\Windows\pppppp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\rrrrrr.exe
C:\Windows\rrrrrr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msioSvr64.dll

Path C:\Windows\SysWOW64\msioSvr64.dll
Size 40KB
SHA256 c063618d99c2bbf44c081291bf5d5de79f0457a62331a08c5b7f3b7021bc2c6f
MD5 ab115477666b3506fc3a27d26fec2e27
SHA1 5b9bab28c375b0862de2f87b1a7d898564df532b
SHA512 df4d232c7b80c2356f75f165c707aa1cc6e1690a58dd6fa785cb5e0114c0a725171de4ae31c72475d905c03e411657c55880c2ba7cf03ab6ed8e0b67e56b99db
SSDEEP 768:Pj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:PjjWYIgMOdb4U68fa
TLSH
T140035D551B0681F2E2EE0534B0AD2F375E7F9D386C545493CF735EEA0D7688AE82470A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msioSvr64.exe

Path C:\Windows\msioSvr64.exe
Size 60KB
SHA256 3113e0fdc955f1939e4e3188ce57ef923fd9c5a8af865470757f811455ae98fd
MD5 f81892b43349b4ba904b0f8bc799a129
SHA1 85adabc470b2873cd7b3438f9e69438ba378aca1
SHA512 3d472dd7fdd8b01efebec386a2fa310b442aec2caff966c6ad87048207a4debde0b0d9e3e1fb8c9432ae693ee0a7e9856d6a8d37c4122c46234bc4571aa70f40
SSDEEP 768:20t8GBj4AmivJ8s5D8/FZuMkmi7dC9q4CD3p88fUL:qyjjWYIgMOdb4U68fa
TLSH
T1E5536D562B4680F2D2EE0674706D2F375FBF98342D549493CF735ADA1D7988BE82830A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2620-1-0x00000000014D0000-0x00000000014D1000-memory.dmp

Download

memory/2620-128-0x00000000069D0000-0x00000000069D1000-memory.dmp

Download

memory/2620-144-0x0000000006A90000-0x0000000006A91000-memory.dmp

Download

memory/2620-160-0x0000000006A80000-0x0000000006A81000-memory.dmp

Download

memory/2620-176-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Download

memory/4876-6-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4876-4-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download