7f9d2507e92482518f20b42672f9c05bc62f79130d2c453353e2ea346e7b1ec0

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe
Size 9KB
Sample261006-prba8sy1ev
SHA256 7f9d2507e92482518f20b42672f9c05bc62f79130d2c453353e2ea346e7b1ec0
MD5 f74dcc3c7f31b33a3cc82ae1cc26b101
SHA1 d9335dbfcbec5dbd0e748d75d737887e7046fdfe
SHA512 a0c4f8406123685b715a28129e6025e1dc1dab223a4708f03528f251617c8a45fd659e8001ef95c6857bf9bbc8d421cab52b4f834c43d60d786ff5bcc007dc5e
SSDEEP 96:v8CNVA1v//eVc/LtPTwsCv1R6NrAu1hCwsLZ5Dvm:ECQt/dTwsCv36PCwsLZ9vm
TLSH
T1AD122983BFB95D62C164A23801EB6B325337C2B87698D1884F18FAB6209F155253878F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4504	130123071419958.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000016d04-3.dat	upx
behavioral2/memory/4504-8-0x0000000000400000-0x0000000000407000-memory.dmp	upx
behavioral2/memory/4504-20-0x0000000000400000-0x0000000000407000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	130123071419958.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	130123071419958.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	130123071419958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3016	jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 4504	3016	jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe	90
PID 3016 wrote to memory of 3708	3016	jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.alr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\130123071419958.exe
  "C:\Users\Admin\AppData\Local\Temp\130123071419958.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

130123071419958.exe

Path C:\Users\Admin\AppData\Local\Temp\130123071419958.exe
Size 4KB
SHA256 26165ad73fb02ba2ee48efb5a1b7ead11b83a944db34d145375a278acb19b067
MD5 d4ef7e871a35764293c625aa2f75d986
SHA1 fcebf937c974f3cb0bc7e218a52342e1871fdb03
SHA512 d54df1bc18f4f03738e6c60afb6e33b65c0b8a8329ffb780592184c44ce793a14b69dad308f6723cfe1c8bd51c8f84adbaec15730cf95e6c3e72c83493d76d8f
TLSH
T140814AC7BEEA1B63C1596139591A7C3279AA1468429F47CA6C28E6F3B4C22F2160CE15
MD5 SHA1 SHA512 TLSH

Submit Download

sysgxnt.exe

Path C:\Users\Admin\AppData\Local\Temp\sysgxnt.exe
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3016-10-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4504-8-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4504-20-0x0000000000400000-0x0000000000407000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads