b7fff9b963953df864dd861692adb38aeaa0198bbd755376bffd7e2f10f297f3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Size 83KB
Sample261009-vt4nfsda89
SHA256 b7fff9b963953df864dd861692adb38aeaa0198bbd755376bffd7e2f10f297f3
MD5 3e9d136b692fd0264aef788175bcacb1
SHA1 e7e5c581f9bb75a1dd184a056cd27ce904bc8b00
SHA512 aadd8a430ad69f8bf6e745929a3e5ae2bc6f02198456a1db36a1a4a30029eb986b0c5a0eb3a0f2ca38adabb16a1c82c9790e6853675fc69869ff143d9de1f1ca
SSDEEP 1536:z6lkV716Hy/mVD2oHt6yd6KzK6oaSbOyejEErxTWDTMqhGKYIZTET8bDQ:z6mCyoD2w6ANPSbOfjBkMqhGKZTbbc
TLSH
T18383D0CB8367CCD0E99B2839A18AA5DEF165144F35F811F4B82591CD91DAB408FFC4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\SetLimit.xhtml	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\WaitOut.mhtml	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.e.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5AD703F-0C2E-9F76-216D-2D69367D8DF3}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "ebxjtstqvrvbhjxv"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "kqcxcxnnbcbwkxsn"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "rjcszhqjjkknhlec"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "qbnthnrnwrbslqke"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "jvjrhkqnnxxwqzlt"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5AD703F-0C2E-9F76-216D-2D69367D8DF3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.e.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "vvlwsrntqernkbjl"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "nvxtebqhrejjbwnk"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "hlqbwrrklkvlqqhs"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "wkhbbkrzbctejblt"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "hhxnetrhqbchbhet"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "elhqlhcrhkrzvjtr"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "ehbjzkhenbccbntx"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "rvrvsvqssrtrtjkn"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "nbwkxtkklbrqskck"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4136-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4136-1-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-2-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-6-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-8-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-9-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-10-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-11-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-12-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-13-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-14-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-15-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-16-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-17-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-18-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-19-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-20-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-21-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-22-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-23-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-24-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-25-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-26-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-27-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-28-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-29-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-30-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-31-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-32-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-33-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-34-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-35-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-36-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-37-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-38-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-39-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-40-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-41-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-42-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-43-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-44-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-45-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-46-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-47-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-49-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-50-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-51-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-52-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-53-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-54-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-55-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-56-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-57-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-59-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-60-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-61-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-62-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-63-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-64-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-65-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-66-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-67-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-68-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-69-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-70-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-71-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-519-0x00000000005A0000-0x00000000005BE000-memory.dmp

Download

memory/4136-4993-0x0000000000400000-0x000000000042C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads