59b4c8c9d0b1cf4e726e876e0d063db8dee00c6cf807e02829f745aed1152214

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe
Size 1.4MB
Sample261009-we4kksdb92
SHA256 59b4c8c9d0b1cf4e726e876e0d063db8dee00c6cf807e02829f745aed1152214
MD5 a48578391480f1ea1d340b13b04a4707
SHA1 da659345d762ffd6cc3a7bb2225758adf05a0a62
SHA512 acbb69a6dfabac43a5ff0ab3092b46d4adb806c8eca8d2aae86294c6e31fe1d76f73a6c825ebdf26f3837057e0b4c8ac3f9268593f3fa05eacba1173130b2885
SSDEEP 24576:5j0ifBwc9ZI8oNBJPu2WA4DR62xVEQNzokrixn9jl8l:x0SwcL2BsA4DvVEPaMZl8l
TLSH
T1CE65231677D2E071C4A300B15AF8AF31597CBE3C4B7E94C7BB902A6D69B13C0A639653
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRIVERS\DMProtectEx64.sys	Service.exe

Executes dropped EXE 3 IoCs

pid	Process
5888	Service.exe
3316	Service.exe
2836	DMProtectEx64.sys

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Service.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3316	Service.exe
3316	Service.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
816	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe
Token: SeTcbPrivilege	3316	Service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5888	Service.exe
3316	Service.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5888	3452	jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pbny.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Roaming\Xinnuan\Service.exe
  "C:\Users\Admin\AppData\Roaming\Xinnuan\Service.exe" -install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:5888

C:\Users\Admin\AppData\Roaming\Xinnuan\Service.exe
C:\Users\Admin\AppData\Roaming\Xinnuan\Service.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3316

C:\Windows\system32\DRIVERS\DMProtectEx64.sys
system32\DRIVERS\DMProtectEx64.sys
1⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Service.exe

Path C:\Users\Admin\AppData\Roaming\Xinnuan\Service.exe
Size 178KB
SHA256 49288fd20ec5314b2921a83c2c1efafbb7b2bd2cd3d0abccfcb97dfa42b90ff3
MD5 01410f3c438169d83a9428b267da48e6
SHA1 737ad6735c56921de8719e398122ab18b9bc5796
SHA512 21663f3925f55b89166ecf9aa1b6025597bbb55efbe3d60d66acfde465a652b4be9467fce972b56ee73605e0acb09a467f4a096dd9c08b4a5035bca86fc24ec5
SSDEEP 3072:W+Ql8YUe6QWsapu1COCYKd3+jNc4S9Kbxr9x4Hc:pQlPaCCOi3+c4sKLx4H
TLSH
T1B5047D2177E0C072D8A3023559E89B7259BEFC764B6A94D3F3D40B4E19707D1AA39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Xinnuan64.sys

Path C:\Users\Admin\AppData\Roaming\Xinnuan\Xinnuan64.sys
Size 203KB
SHA256 41e5267e4782004fed6529fd018cee2476466a1157879b4e3a77a11e91938451
MD5 6bed2ee4768a72029bf81645eeeb1410
SHA1 1afe6ebd246922d26d06bfd96925a5ba54f36432
SHA512 3c32ab1914bf593a9aac849024979229e4a794ffe3083433bc18456aacb54a0d20691017c289f1c0eb060931fe050ef56bcc018def446428a6bc746d8b93f317
SSDEEP 3072:Kj71fgvjkiGZ9i8VpPLV9+pRMvghLXLzfO/ciUON4qIxo5ZUMhMQVuES:KOn8rVf4pCvghTLzfqc4N9bUBQV9S
TLSH
T156149E1277E0C4B3D897047585A5D7B6A97AF131072586CBB3A04BBE1F217E06B3938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2836-29-0x00007FF76F2C0000-0x00007FF76F2F7000-memory.dmp

Download