bec59ae736f5568404be9c712408dba856be43485378136b4cf912977b15c740

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe
Size 532KB
Sample261006-phbweaeh36
SHA256 bec59ae736f5568404be9c712408dba856be43485378136b4cf912977b15c740
MD5 d916c9075429b554f13e0e5ad17a506d
SHA1 55f136c6430fc2b33dfa5e4b8e0a47ab6435646e
SHA512 8a92551fe13ecbdb2c4b3b08e74bd05532f8f95f6d7489baefd59151be7cd9785a040daa586307a3b8cc7085043da282c05067077e84640530112ca5e6b09f0d
SSDEEP 12288:SvfyIIIzAClE7uDOch+h2ul/mJohNDuBQ:esSzlEqF+hVcOhv
TLSH
T198C422477BB62AA1C0AD4A3114735B22FA7AFC399950460B5FD8FD4F0DB0962843BE47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4848	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5e6-3.dat	upx
behavioral2/memory/4848-4-0x0000000000400000-0x0000000000527000-memory.dmp	upx
behavioral2/memory/4848-13-0x0000000000400000-0x0000000000527000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Your Product Setup Log.txt	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main	irsetup.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www1.odn.ne.jp/yahell/institucional/portuguese/oficial.html"	irsetup.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4848	irsetup.exe
4848	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 4848	5128	jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
  __IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.SetupFactory.b.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
Size 440KB
SHA256 d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1
MD5 75ca7ff96bf5a316c3af2de6a412bd54
SHA1 0a093950790ff0dddff6f5f29c6b02c10997e0c5
SHA512 b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4
SSDEEP 6144:JgHXCFdoW/HotZk9K0C4mXE7EbmSIPzjZivhzO2PJehlNAI04Jl47sHvEh4UjfzS:cyIIIzAClE7uDOch+h2ul/mJo
TLSH
T1E8A4238B77B62D61C0AC4E3124672221FA75ED7DA880472E57D8FC5F1EF4912483FA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4848-4-0x0000000000400000-0x0000000000527000-memory.dmp

Download

memory/4848-6-0x0000000000526000-0x0000000000527000-memory.dmp

Download

memory/4848-13-0x0000000000400000-0x0000000000527000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads