b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6

Analysis

max time kernel
3s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
Size 37KB
Sample260925-wm5slsshjb
SHA256 b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6
MD5 f493fd57ec9a6183be11c09983ddbee9
SHA1 0a8c439a1acae7cfc6423e4d205c034084b751da
SHA512 210124815602453559e60c9ce4fe57eab2cc94bb0159b92f7f49ee938e05e9d3d11f85f1156e28c62f4bb3bfc32c4dfaceeefc7ae7e2f301b64b60494fee7589
SSDEEP 768:IbuLxe6quPbBDZ0LvVZdznv9I6aOSYcuDd1ts2hRxqxWTh/:IRduPZZ0Ld77tPSrxWTh/
TLSH
T13F034A52AB4541B3E3DE013034AA2F375F7E9C3A69956493CFB343E92DB9592D43820B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2472	upxdnd.exe

Loads dropped DLL 2 IoCs

pid	Process
4204	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
2472	upxdnd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upxdnd = "C:\\Windows\\upxdnd.exe"	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\upxdnd.dll	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
File created	C:\Windows\SysWOW64\upxdnd.dll	upxdnd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\upxdnd.exe	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upxdnd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4204	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
4204	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
2472	upxdnd.exe
2472	upxdnd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4204	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
2472	upxdnd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 2568	4204	jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe	81
PID 2472 wrote to memory of 2568	2472	upxdnd.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2568
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4204

C:\Windows\upxdnd.exe
C:\Windows\upxdnd.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

upxdnd.dll

Path C:\Windows\SysWOW64\upxdnd.dll
Size 30KB
SHA256 0bf99b7b4550c1119ad32d6d4249dae58f2cc98ce96ae944674b33b89d4b76af
MD5 ab738735a2cec46bd4c37e087003eb74
SHA1 6273ee1152870f091c858eee8e539c9962cc83f4
SHA512 ea4deba5a41e479b17d9639caeefe971e2be00b78f7b623d8f4ff54c5706f15b26f68f30fc1962573f11d1987b6d3bc06cc308414c5c17df96a264a7c0c03dd1
SSDEEP 768:juPbBDZ0LvVZdznv9I6aOSYcuDd1ts2hRxqxWTh/:juPZZ0Ld77tPSrxWTh/
TLSH
T145D239629B4941B3E3DE523070AA2F371E7E9C3A68916453CF7343F92C6E585D83960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upxdnd.exe

Path C:\Windows\upxdnd.exe
Size 37KB
SHA256 b0a38c65a4a55e7f479751b8ba0d5d93bad3ac3235a9390581689b8b1ad928f6
MD5 f493fd57ec9a6183be11c09983ddbee9
SHA1 0a8c439a1acae7cfc6423e4d205c034084b751da
SHA512 210124815602453559e60c9ce4fe57eab2cc94bb0159b92f7f49ee938e05e9d3d11f85f1156e28c62f4bb3bfc32c4dfaceeefc7ae7e2f301b64b60494fee7589
SSDEEP 768:IbuLxe6quPbBDZ0LvVZdznv9I6aOSYcuDd1ts2hRxqxWTh/:IRduPZZ0Ld77tPSrxWTh/
TLSH
T13F034A52AB4541B3E3DE013034AA2F375F7E9C3A69956493CFB343E92DB9592D43820B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2472-14-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/2568-1-0x0000000000D10000-0x0000000000D11000-memory.dmp

Download