2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
Size 3.7MB
Sample261002-j89bpszv2n
SHA256 2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447
MD5 2756e39afeceadb6c83b615be4b49aff
SHA1 2bec27d7a6caef9839394ccf0a15af768e5068d1
SHA512 434fa9c8d6b8e3c1376e0bed5f5c038f2a8365b0313bc5d9f16a95358785af86d37bcdf794a6291d186b0b7f9d61838431a3de294c98247c7d4e9d4caed5cc14
SSDEEP 98304:4sHG6HKW/swhhad23PavDGxp4ETekp0eR0NtrKYNDHI:4sHG6HKW/lxSvDNOekieR03KYNDHI
TLSH
T14A060222B2918C7AD1E1803086F6F775D6B1EF2907254D83D3E4F9BC3A36C495E246E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c496-20.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
5008	genuinelampiweb.exe
5552	lanzador.exe

Loads dropped DLL 1 IoCs

pid	Process
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
File opened (read-only)	\??\D:	genuinelampiweb.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c496-20.dat	upx
behavioral2/memory/3668-23-0x0000000010000000-0x0000000010053000-memory.dmp	upx
behavioral2/files/0x000d00000001c499-26.dat	upx
behavioral2/memory/5008-32-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/5008-34-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/3668-35-0x0000000010000000-0x0000000010053000-memory.dmp	upx
behavioral2/memory/5008-46-0x0000000000400000-0x0000000000596000-memory.dmp	upx
behavioral2/memory/5008-48-0x0000000000400000-0x0000000000596000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	genuinelampiweb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lanzador.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe
5552	lanzador.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
5008	genuinelampiweb.exe
5008	genuinelampiweb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 5008	3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe	89
PID 3668 wrote to memory of 5552	3668	jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2ddd7dc770de88f1980b77af172d937559ae35c8f4e514321b01ffbfcb5d2447.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\genuinelampiweb.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\genuinelampiweb.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\MMBPlayer\lanzador.exe
  "C:\Users\Admin\AppData\Local\Temp\MMBPlayer\lanzador.exe" C:\Users\Admin\AppData\Local\Temp\MMBPlayer\new
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

genuinelampiweb.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\genuinelampiweb.exe
Size 558KB
SHA256 bd7a110cb5311d247b5c0d3cff03418afc9d27d81e0b1f1807c663cbd5305ca7
MD5 dfec79bc897dc6cbe670df5f82ef5afb
SHA1 ae32720fc3950cb6eea5ad2a286e1178ea3fc615
SHA512 8725c296deae11cb0078c7959966b675ce77950d2da6e162f37ae77a55d045324aed11b394c78450d5a60b2eee4b9454c10cf2f36cefa62120bbb7543d907f15
SSDEEP 12288:+TkLn8a0gC+khD5YMlLKv3cLXsUp8sQ3crW0/rRcWSTQeS/pDeg79x:9ntiBCMlYsLHpBQ3+/rtSc1hyg7H
TLSH
T1A4C42325FBB05418CC3B5E3362DBAD011783BD3DD16D7A0531AE41A8BA3E699C9106EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lanzador.exe

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\lanzador.exe
Size 722KB
SHA256 6554b382c3a85c878a4d6d43e7bf6ed5e506420c21ef00a017837363a5a0451f
MD5 375b6e367dc8070bfdb3d942496c11e1
SHA1 28938ab3b39374d63dd834c889b85f85832f5c92
SHA512 5048ce6fdc25f0c5684205fee54d776b9aa245640c884b50126cd8f763539abadc629b36f4555bf4d9630856ce506c2391e5b7e8d8c8697d5dcefae2e18d0982
SSDEEP 12288:gFes5z6gE9hCX/2ntmvj85T/q9z8KomAJ2t4Ujd4F4aCLzzV+XMJk:wHU42ntX5Ti9z8KNCbedaCLl+X6k
TLSH
T17AF4AF22F5D58072C2B322B19F7EF366963E79360336C2DB27C81D715E605816B2A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

new

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\new
Size 353B
SHA256 3d106ab55e2d40d9cdd8f27a438cf3319c8bba44ff63343ac6eecb5377b4b1f5
MD5 4375df15b719ff2bf3abfe6a0085c6a6
SHA1 eaf54e5cb6b6020606b0f1fc8c19c9843e8ec1f4
SHA512 6e18211bee496a9a942668730b88511d6fae936e1e4d5fc756c3306c1d197076999bb896ea32ac23a5722bcd8a304ca00208244e67acc654689dbb890e8b647b
TLSH
T153E0C067C716CFA66045805033E1298E71947F8187F4B2C2FD60450F7C9A73B69075A0
MD5 SHA1 SHA512 TLSH

Submit Download

plugy.dll

Path C:\Users\Admin\AppData\Local\Temp\MMBPlayer\plugy.dll
Size 101KB
SHA256 a1fd1be2ff1f7eb0f96e33f1e73b5150f4c15142785ddbe99b8f9e6fab3dea29
MD5 260e2e96edcd247c4a8977d67f1aa3c6
SHA1 04547ef3a953a440fe4b7e4e9a6870c20633d6d0
SHA512 44580439f5fe63089519b2f5f03fbdf13f04dbeaa385cc3a4196cc84b9bd440d8564c99b33407ee1a24f2bb99889dc121e383eacb251951c220540190b5ddd39
SSDEEP 1536:L/ljo4nSK+fTbqa9NWeNfq5LL/DohI3oHdfQBdZ7omfq2MjXaUj8Q77oDWhOc:L/lM4G9vY5LbcYo9fwZkrXJjX7oyhp
TLSH
T1E2A3F1AAF71441F8DDA39DB11463E9360483FD5B91ACBB225AA12F4D25FFC894813E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-35-0x0000000010000000-0x0000000010053000-memory.dmp

Download

memory/3668-23-0x0000000010000000-0x0000000010053000-memory.dmp

Download

memory/3668-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/3668-2-0x000000007488D000-0x000000007488E000-memory.dmp

Download

memory/3668-1-0x000000007488D000-0x000000007488E000-memory.dmp

Download

memory/5008-32-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/5008-33-0x0000000000595000-0x0000000000596000-memory.dmp

Download

memory/5008-34-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/5008-46-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/5008-48-0x0000000000400000-0x0000000000596000-memory.dmp

Download