029f4a58ce70d1eee8b67afad9ef665a5d162f4323b76363fadffab9b83a5e47

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
Size 69KB
Sample261006-tfexhafe32
SHA256 029f4a58ce70d1eee8b67afad9ef665a5d162f4323b76363fadffab9b83a5e47
MD5 38bf4c160626f03010bd3a87f3cee6bf
SHA1 6f19b9a25c82e531f7f294397552ebc6070f65db
SHA512 7223ad97510dd057e6848e3ce5690e2c5098a52a091edca85f645ff743034a5c1d9594089028bdc24123a09adfa9d20105f450b140d78a670ec6e1a99e3ad6e6
SSDEEP 1536:vqk547qWnrvleIoP7Tl7eF1oX9UCO7sdDrnR0oGtBm8V8op355ySlUTyIn:vqkSnnrvlQP3lqzoX91Dr+ofo0Sl2v
TLSH
T18363128BA89CC59ADD6638B7194FF7AE30380144C268980DCF5B39C79C98116A1FFC93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4564	ucsl.exe

Loads dropped DLL 1 IoCs

pid	Process
5108	regsvr32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uc1362.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
File created	C:\Windows\SysWOW64\ucsl.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
File created	C:\Windows\SysWOW64\tmksrvu.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
File created	C:\Windows\SysWOW64\xplugin.dll	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3520-0-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral2/memory/3520-12-0x0000000000400000-0x0000000000434000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\nsdb\hosts	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ucsl.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3464	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\SetHP = "yes"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main\SetHP = "r9k687474703a2f2f6e65772d7365617263682e6e6574"	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\CLSID\ = "{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID\ = "XPlugin.XFilter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\ = "XFilter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\XPlugin.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\ = "XFilter Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\AppID = "{AC3F36D4-F905-4FE9-A926-EB937E66F591}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter\ = "XFilter Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\xplugin.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\TypeLib\ = "{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CLSID\ = "{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ProgID\ = "XPlugin.XFilter.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XPlugin.XFilter\CurVer\ = "XPlugin.XFilter.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}\ = "XFilter Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html\CLSID = "{4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\ = "XPlugin 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EE79D398-AAAF-47B1-8C9E-11F7D4C9111B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\xplugin.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{AC3F36D4-F905-4FE9-A926-EB937E66F591}\ = "XPlugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\XPlugin.DLL\AppID = "{AC3F36D4-F905-4FE9-A926-EB937E66F591}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4564	3520	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe	89
PID 3520 wrote to memory of 5108	3520	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe	90
PID 3520 wrote to memory of 3464	3520	jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.iz.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\ucsl.exe
  C:\Windows\system32\ucsl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32 /s C:\Windows\system32\xplugin.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:5108
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Gathers network information
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ucsl.exe

Path C:\Windows\SysWOW64\ucsl.exe
Size 2KB
SHA256 8035573e68267cdeca2983ea72a04d4f34edc5102bbbcd7fab562eb357a5ae58
MD5 61f997cf39875601a45bf73daf8d5328
SHA1 2ca3151d2dde4af571fe74dac883c6a7b76b8a12
SHA512 49e92fdb9f9bd2376af5fdd2a32c4b00a2d8c4993e55655b8a3298bff2f928598e1bb780909d289290015b08bed6533ad65a5ee1de6d64e4d6274edf073bae7b
TLSH
T1B24154DF8D8445B3D2585FB429406C1AE667E46C03DA8CF247B0528256FABB363F8613
MD5 SHA1 SHA512 TLSH

Submit Download

xplugin.dll

Path C:\Windows\SysWOW64\xplugin.dll
Size 100KB
SHA256 6f100983272d618ccfe4d8e32965c0258e7b7b536c5bdcc10b3235ee975b427b
MD5 284d86041cd47cbc753a52f4c7f56e2a
SHA1 589325103bf7ceaa905d422cc73443101fc3601c
SHA512 76dede4bff7c13fda20251286fbd87dd1e38f53cf561c78c94b0e3d259dcc258103fac691dc5a0a03de518bac448a724da6fe7618df07741243245827ea4c8ba
SSDEEP 3072:V6i126BwHqKwtaVnvnyxNj9RVyWIfgL1VBcO1QP:Ii126BwHqKwtaVk9RVAg1Vr
TLSH
T12FA37C923AE141F0E54D047804666736933BAE558FF649D36F1CFB5CAB32692F93A302
MD5 SHA1 SHA512 SSDEEP TLSH