044794b30a4d8e0bf278863bb888e08f3251be116e7583828e91a7e3c462d1c0

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe
Size 1.6MB
Sample261006-phmb5sa18j
SHA256 044794b30a4d8e0bf278863bb888e08f3251be116e7583828e91a7e3c462d1c0
MD5 65d3de91ffba0a66b4dcf15f77357da2
SHA1 370eec63b3f6dd335e9ae59a181d935f6a609971
SHA512 bc7d7fd7e5990de68bc48555f580482952bf99346012c7396cb3f5c796f673791c2fcfc501ad1d71973669ba326cad355e7f3c5720f0c959c90b23d832e16ac1
SSDEEP 24576:Wh8DHBbgGP22ijMFHyLOFqH5SUIKIv/Me7xhSG/IgM6IWoMHtHBBgSE9ILln8V3:GgjP22DsoqH5SUEl4xLLstHBeFIV8d
TLSH
T1BD85230FBEC27C73C0344B7919B2B5305A6C312C34598690FEFC6F96F8A5E85A664B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 defense_evasion discovery persistence upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x001100000001c4be-24.dat	acprotect

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000001138c-3.dat	aspack_v212_v242

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1032	win32.exe

Executes dropped EXE 3 IoCs

pid	Process
3448	wife.exe
1032	win32.exe
5532	win32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win32sys = "C:\\Windows\\win32.exe"	win32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\win32sys = "C:\\Windows\\win32.exe"	win32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\usr32.dll	win32.exe
File opened for modification	C:\Windows\SysWOW64\usr32.dll	win32.exe
File created	C:\Windows\SysWOW64\P.txt	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001100000001c4be-24.dat	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\win32.exe	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe
File opened for modification	C:\Windows\win32.exe	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wife.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1032	win32.exe
Token: SeDebugPrivilege	5532	win32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1032	win32.exe
5532	win32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3448	4956	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe	89
PID 4956 wrote to memory of 1032	4956	jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe	90
PID 1032 wrote to memory of 1968	1032	win32.exe	81
PID 5532 wrote to memory of 1968	5532	win32.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1968
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Sinique.a.exe"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\wife.exe
    "C:\Users\Admin\AppData\Local\Temp\wife.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Windows\win32.exe
    "C:\Windows\win32.exe"
    3⤵
    - Deletes itself
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1032

C:\Windows\win32.exe
C:\Windows\win32.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

266_apv_cfg2.cfg.$$$

Path C:\Users\Admin\AppData\Local\Temp\pte_tmp50543\266_apv_cfg2.cfg.$$$
Size 4KB
SHA256 3de54415e3f84610045ac71dde3599d6d9481d44085bc7d11330bdaa6c9e7e52
MD5 2fc15ed410c743a48ebfb973d166a572
SHA1 276a1688f49e10b8b18c460527ee867b5b475392
SHA512 24de62c15e9a201f60b2d2aaebb8e97a0d74074de2484fbac25fe1b9e3fc12971dde2d4190ab21f2a67b8eafd54445566e5722b34d5cdc5d93aab44b887675ea
SSDEEP 96:BUF6+s/YilUkw9EImnDm3AhUrGrRSPSxS+DZbPiEZn1T:B1l/YIUB9ElS3biV87K7
TLSH
T131918D08027B4C1533673A25D9DBD5FACA6F54220908324F03C991BEA50961DED9FE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wife.exe

Path C:\Users\Admin\AppData\Local\Temp\wife.exe
Size 1.6MB
SHA256 8458596ec044a0426f4caf066e180fd92e8e18d2be1fa55105f8b38873653927
MD5 c64534648b45e461719fe1b5000e2e2e
SHA1 31de91e0736fafdc312cb459533878086082234b
SHA512 a6dc2814822b82a773b73cb0314cf8bc4873e7eb524e84da770d36771532d154222901249ed511e1e591d3b845bd226d49e43623f40fb185607adb9cc4365623
SSDEEP 24576:yxAQJVc4jhIbKOVy5MGANwSj38OiDG2XOJkzAI92kvtiVH:y1hjMKgsZAHsOsG2X2k/92GtEH
TLSH
T15D7523175C814A5BFA650234BE172BAAAF4B6E0C4D726EC36777F2DDBE357021C89024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

P.txt

Path C:\Windows\SysWOW64\P.txt
Size 85B
SHA256 b3d726b533c3eb2187fbbd272988b600355612083172b2ae487a14e7db3d808d
MD5 a18d84fcca7111f38c77b61a839728bc
SHA1 c6244cf89eae9539d17f5db93bd0b48d7b3497f5
SHA512 e97e029f45c98671dc42c166c44142a678ae6e7bd87d5245035123b454c6916f759d229a8d1c141567f098d01551308a3c2410a74d2e54ecae554d4e33a4db90
TLSH
T152A0110C82838A080800E83B80388B8E802008083A8A3B200322C08CA2B00AAA282B2B
MD5 SHA1 SHA512 TLSH

Submit Download

usr32.dll

Path C:\Windows\SysWOW64\usr32.dll
Size 28KB
SHA256 fc48de1f8a998f8b8dfecee1d05acf94bfe8fc2806ce51ae799d8140190244ca
MD5 db6f3fe762455c85685228981e925e15
SHA1 5c1eb8e23b1589dfbb014cda6f6da4858aaf20ba
SHA512 8594b3a52b245e0c1c9e5fce383ffd8ff5dc958715357e956a93e831d878ca0f0209a949f74a980d8a847ef9fe07ebf33cdb0458036f965b491fe50ec184fd99
SSDEEP 384:V0/hQZeADfLzqiNcT/el6eslRaQTbAJ8ByGol+aJcPWbkzbhDxjUm1Am0q:chkeArL2rTce68IT+ECZVjUm15
TLSH
T1C7D2D0DE33D6E4E2C24256B21B4C898F3627AE10084E3264E793D21BF09F1FDED51546
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32.exe

Path C:\Windows\win32.exe
Size 1.6MB
SHA256 044794b30a4d8e0bf278863bb888e08f3251be116e7583828e91a7e3c462d1c0
MD5 65d3de91ffba0a66b4dcf15f77357da2
SHA1 370eec63b3f6dd335e9ae59a181d935f6a609971
SHA512 bc7d7fd7e5990de68bc48555f580482952bf99346012c7396cb3f5c796f673791c2fcfc501ad1d71973669ba326cad355e7f3c5720f0c959c90b23d832e16ac1
SSDEEP 24576:Wh8DHBbgGP22ijMFHyLOFqH5SUIKIv/Me7xhSG/IgM6IWoMHtHBBgSE9ILln8V3:GgjP22DsoqH5SUEl4xLLstHBeFIV8d
TLSH
T1BD85230FBEC27C73C0344B7919B2B5305A6C312C34598690FEFC6F96F8A5E85A664B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3448-29-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-32-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-11-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-40-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-27-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-28-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-10-0x00000000004AF000-0x00000000004B0000-memory.dmp

Download

memory/3448-30-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-31-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-39-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-33-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-34-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-35-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-36-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-37-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/3448-38-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4956-19-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5532-26-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads