3f0c29917b21aa0da68ebdb76cc0b175003c6bd7abc54851d01713bc3c53face

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe
Size 199KB
Sample261009-xaprasdf43
SHA256 3f0c29917b21aa0da68ebdb76cc0b175003c6bd7abc54851d01713bc3c53face
MD5 be05cdb5fbfed03aa29b207fdfb0dcdc
SHA1 4eb3185c7e29ed5fd406ad3fe93037d9b675b427
SHA512 a019f9844e96a08524c10baaa87508b6c89a12efff1da91f5a188ef74c44bde0a743235abe5e626c3767cfe0655e3be0a5a6a862e80a8cf84f249c0d81befa41
SSDEEP 3072:3lDwz55BBklDwz55BBU0qhjvUWtWhfrrx4emH0qhjvUWtWhfrrx4emY:3hwF2hwF+3vUWt4jt4x3vUWt4jt4e
TLSH
T1F1140208AE50E375C2A1F834DFB9D9B6FF25B5B1C8091E328769040F18554682F9DFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}\stubpath = "C:\\Windows\\system32\\winlogo.exe s"	server.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\SOFTWARE\Microsoft\Active Setup\Installed Components	server.exe

Executes dropped EXE 2 IoCs

pid	Process
5908	CLIENT_REAL.EXE
2784	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\startkey = "C:\\Windows\\system32\\winlogo.exe"	server.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\plugin1.dat	server.exe
File opened for modification	C:\Windows\SysWOW64\winlogo.exe	server.exe
File created	C:\Windows\SysWOW64\winlogo.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLIENT_REAL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	CLIENT_REAL.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	server.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 5908	4440	jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe	90
PID 4440 wrote to memory of 2784	4440	jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe	91
PID 2784 wrote to memory of 1948	2784	server.exe	80
PID 2784 wrote to memory of 5588	2784	server.exe	93
PID 2784 wrote to memory of 5588	2784	server.exe	93
PID 2784 wrote to memory of 5588	2784	server.exe	93
PID 2784 wrote to memory of 5588	2784	server.exe	93

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1948
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.ExeBundle.b.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\CLIENT_REAL.EXE
    "C:\Users\Admin\AppData\Local\Temp\CLIENT_REAL.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CLIENT_REAL.EXE

Path C:\Users\Admin\AppData\Local\Temp\CLIENT_REAL.EXE
Size 99KB
SHA256 33a589ae8bcbfd6e0f4d95e335fdb2e54540f66991cd2912629a9e7cb559a289
MD5 6285625f3b9fffe6c4e9fd2abb3df2cb
SHA1 5306ea9d38378f8c0b8446a73f6e32e5a8e893e2
SHA512 c75bd943847f35d65be531607723ce804cbd4d11b43b2b4abf0b4af902df8f771c1419ebbc5c5e432c675552407f7b17d4ec540cfcc7aa6df4756cac75998526
SSDEEP 1536:3lOewkbDc55iQyavc0qesbkIvHklBAwM8OBt3r5WU4JfuqytIxXUh4iDKmY:3lDwz55BBU0qhjvUWtWhfrrx4emY
TLSH
T13CA30208AE50D375C2A1F834DFB9E9A6FF25B5B1C8091E328768040F18554682F9DFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CLIENT_REAL.INI

Path C:\Users\Admin\AppData\Local\Temp\CLIENT_REAL.INI
Size 353B
SHA256 fd239ab66b32b7104de5be66dd2fb34999e71a4d63eb184ec1c33511ceaaa32c
MD5 e2bb9548fae23274bea4438c2015fd30
SHA1 bb95ad3bacfa004c6f6d93e92689339db6deedab
SHA512 d55915f5fcb5b20cb159c47e3b365010f3754b63faa417e37e416d14282fc01b0e444aa84c047b2abfd1f808f58448a3d99d75d2c7a7dbb0ef58dd789ec04600
TLSH
T158E046242DC859C8386031BCAEF230FBA9C73C146109752412007C210C47A8BD17EDF4
MD5 SHA1 SHA512 TLSH

Submit Download

bundle.INI

Path C:\Users\Admin\AppData\Local\Temp\bundle.INI
Size 353B
SHA256 2ddf3f08aa062ab18abe534bf000297af86717dcca335b30ce7c95f53605a54f
MD5 0d1102a838bcb5dc36651d67a4ddf956
SHA1 02869b2e82b0c7edf83728391d330c150a87c69f
SHA512 9331896ef6ab36c841e89c42b2e4f7f1e6efd63ff1155d1ff4f7bf314dfd418a591e2d62d46dbbb9fa15cf00577e934a1ee470c21bfd08fb7112336c52281553
TLSH
T164E046205DC859C8386031BCAEF230FB59C32C14240976241200BC210C4798AD17DDF4
MD5 SHA1 SHA512 TLSH

Submit Download

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 70KB
SHA256 50130dd3c4a2313d3cd4bc127c815fcb87c2bdb50941f2690f2bd461c1c07e93
MD5 9f53eed6e4088395a86904315c112313
SHA1 8153c97ab70952bf5d11cc50c9f087c9217d411f
SHA512 f65a0e605a6fb47a6692d3dd7ae9cfa1eea5f2f20752fccd59e03e731d434c53a73714ef318354f46bb7698f4f0d2aab5262647e0530ef1da94707b33913a485
SSDEEP 1536:j0qesbkIvHklBAwM8OBt3r5WU4JfuqytIxXUh4iDKmQ:j0qhjvUWtWhfrrx4emQ
TLSH
T1216302117A119176DBB9A134EBD4EAE89776A7F5C40A0D22C7EE044F2060CB43F9CBE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-84-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Download

memory/2784-88-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4440-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4440-81-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/5908-87-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads