ee73979fabf337323e09c053a07a23426318204c2fd34ab8c22f31a3f09ec420

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe
Size 36KB
Sample261006-ppkf5ay1ct
SHA256 ee73979fabf337323e09c053a07a23426318204c2fd34ab8c22f31a3f09ec420
MD5 c82b1178805107642677889c5c283fc3
SHA1 8e9249917f2d289be320a6e5fef35b9b182ec777
SHA512 4b43d5e8397773b56198b9b5e91acdb4c86636c59bb126154217ae1b845be244acd5b37ac804641d8b9489ae399a4522303fc50210bbef50ed872675d7f8eebb
SSDEEP 96:akVMQq9MbY6DnGhPtboynRr66C4B6VickzglH0zIpExBmNmRqmTabfJA1Ptboynq:a+RqP1oynRGg2O2f6mNmRqmSK1P1oyn
TLSH
T13FF2E84BDB6448F1EBEE8EB01916094C8F534866076084F70AB70ACDD4B9D03B93BB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1876	dlsmgr.exe
2276	dlsmgr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dlsmgr = "C:\\Program Files\\dlsmgr\\dlsmgr.exe"	dlsmgr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dlsmgr = "C:\\Program Files\\dlsmgr\\dlsmgr.exe"	dlsmgr.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\dlsmgr\dlsmgr.exe	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dlsmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dlsmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dlsmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dlsmgr.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlsmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlsmgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5872	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe
5872	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5872	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 1876	5872	jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.aii.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Program Files\dlsmgr\dlsmgr.exe
  dlsmgr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1876

C:\Program Files\dlsmgr\dlsmgr.exe
"C:\Program Files\dlsmgr\dlsmgr.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dlsmgr.exe

Path C:\Program Files\dlsmgr\dlsmgr.exe
Size 16KB
SHA256 4a1e317acd6600fa882e0e8a104b716d24960deb938bb91fd34a93d865a3c348
MD5 b45d07660d221d31fdc7eaa92dc6988d
SHA1 4d3058f57387b9cb5392da6f9a80eb3a6bc2d3af
SHA512 cb21210acdffe07a97dcff353f68822c0375edbb755024a643327df2326c9b49118899bc2e733e7ccd063ce07a216f7899b15df4c7eaf6993d6cd4953d559711
SSDEEP 96:AB6VickzglH0zIpExBmNmRqmTabfJA1PtboynmH:y2O2f6mNmRqmSK1P1oyn
TLSH
T1B572A42BE66418F1FBFA03306C05599A8F039E68031089EB14B316C7C42AC83E43EB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dlsmgr1171[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\60SJCADA\dlsmgr1171[1].htm
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download