Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 15:58
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe
- Size 28KB
- Sample261006-tek25a1xe1
- SHA256 d3db14079a86eaee8c0b395cb359069eeb61e7045d1620e046fcd33e8d841fa2
- MD5 7e5efbaf06143506ff068548384b72fe
- SHA1 beb15ddecb951b48e74dd11742f261a8834037d5
- SHA512 e0f985dc84b84d4969c3205b2bcfb93258e301d8fea42adf8054c70f832035cbcdca9400221e63eae7393a30be36291670b351fdf545722508a9e4b1893f55b1
- SSDEEP 768:ISmiXtf8u2btaaE5bs8Jx7hVCjSevkxv6jaMgd:ISmiubtaaEdfjf8SJv6Tgd
- TLSH T106D2E04A39E89D32D944513BA3C5B289534460542BE620F98F9CD9DEBEB24706F30772
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe - Modifies Shared Task Scheduler registry keys 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{12345678-0000-0010-8000-00AAFF6D2EA4} = "Sysctl Desktop Handler" rundll32.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000f00000001c58b-5.dat acprotect - Loads dropped DLL 2 IoCs
pid Process 4816 rundll32.exe 896 regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\popup_bl.dll jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe File created C:\Windows\SysWOW64\systr.dll jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe File created C:\Windows\SysWOW64\searchdll.dll jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe File created C:\Windows\SysWOW64\guninst.exe jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe -
resource yara_rule behavioral2/memory/4608-0-0x0000000000400000-0x0000000000413000-memory.dmp upx behavioral2/files/0x000f00000001c58b-5.dat upx behavioral2/memory/896-7-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/4608-13-0x0000000000400000-0x0000000000413000-memory.dmp upx - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} regsvr32.exe - Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.hotoffers.info/171/" rundll32.exe - Modifies registry class 52 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\VersionIndependentProgID\ = "Serch_hook.transURL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12345678-0000-0010-8000-00AAFF6D2EA4}\InProcServer32\ = "C:\\Windows\\SysWow64\\systr.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\ProgID\ = "Serch_hook.transURL.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\TypeLib\ = "{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\ = "serch_hook 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\searchdll.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib\ = "{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12345678-0000-0010-8000-00AAFF6D2EA4} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL.1\CLSID\ = "{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL\CurVer\ = "Serch_hook.transURL.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\InprocServer32\ = "C:\\Windows\\SysWow64\\SEARCH~1.DLL" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib\ = "{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12345678-0000-0010-8000-00AAFF6D2EA4}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL.1\ = "transURL Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL\ = "transURL Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL\CLSID\ = "{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ = "ItransURL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ = "ItransURL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{12345678-0000-0010-8000-00AAFF6D2EA4}\InProcServer32\ThreadingModel = "Apartment" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\ = "transURL Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7EDAB21-D7F9-11D8-BA48-C79B0C409D70} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7EDAB2D-D7F9-11D8-BA48-C79B0C409D70}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Serch_hook.transURL.1\CLSID regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4608 wrote to memory of 4816 4608 jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe 89 PID 4608 wrote to memory of 896 4608 jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe 90 PID 4608 wrote to memory of 5100 4608 jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.hy.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\systr.dll,load2⤵
- Modifies Shared Task Scheduler registry keys
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
PID:4816
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\System32\searchdll.dll2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
PID:896
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\System32\popup_bl.dll2⤵
- System Location Discovery: System Language Discovery
PID:5100
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\searchdll.dll
- Size 21KB
- SHA256 7ba74d15605422650635d1095608c8755f8109c4f6688886c1896bff2880df42
- MD5 372babf0acfda624032371cd99749ea5
- SHA1 b5d582b22ab0e1ccc0eba9a9f4ad15a7050bfd78
- SHA512 31e49ad49615db6d437ac32a30d3bb6abe2c61813fa7f372c7df44b05a2d48751ed5fb88a91845c7ef692d8848019980d761ada7c7952566b07ebda7ee9258ba
- SSDEEP 384:KjNjU/PJfGvSrVGG6zRZ+EHpvwtVxwXWDQsZCYHNDyiI90LK3PR:KBjU/BOvSJGDjppvBWDOiUfR
- TLSH T1DFA2AE07F79CC5A5DDAB1B3A18A3C9C1C004BD918EF9659B7E48371F6D389009F682B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\systr.dll
- Size 10KB
- SHA256 0fa006ed7c6425d1f4857a85bf31fb45f15520049d3d49c5ea96b45d2f4853c0
- MD5 8230f053db8eb4e9db1fe175c499fee7
- SHA1 b72cd3dd78d8ef613d6d918f9a945f81cae89ed1
- SHA512 1605acbdf5deee14a0541a8b75677653a46e0772eee06c0e2e041e035dcff0c38e21aaf096f7f178ae73a10ff3fd7fc579381fb0116d70fb5dc8e66e783d820c
- SSDEEP 96:j/EKVqTseipmRxbz2ewx8koiSI78bY3UM7K27cjbLZYfBBcsFo2YDRp:j/B+seYmRtDwx8k9G10JcjJ4BcQto
- TLSH T11A22B49FB15844A2C06D2332318EA72A847E6625A1E81186CF618D209EF9914FF3C34F
- MD5 SHA1 SHA512 SSDEEP TLSH