8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Size 144KB
Sample260930-m7pgpadf87
SHA256 8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c
MD5 d1a903d2b3e77427eb9c999497eaceda
SHA1 2773e650436799595c14385665cd1421fa0b6aa3
SHA512 9ecf9ee19e407243daaf1d85d914c781b27ae643f9834dd3374dad5be0be4a585000e8d4653cf1b89a534823400b5982132e25708149da466a7896ae730fd5ee
SSDEEP 3072:KbAZSWD/Vubd8yoWHkkJQNEVWfiHyNKrOdWoqaJdPC:KfWD/cbicEkJQqVWfiHyN8OX
TLSH
T159E38D1234D2C4B6C6DE853D1A569B39D3BBA670DFE24B435F149F4C1D35A828D3A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Startup = "ComputerStart"	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\StartShell = "ExplorerStart"	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Shutdown = "ComputerShutdown"	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\DllName = "xpserver.dll"	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xpserverdll\Asynchronous = "1"	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xpserver.dll	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
852	jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8c3b621e59e7565032bcad1588df7c1864ce14fed25863d9ec37db9ceec9925c.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:852