52cc81731e98a6d8b0811bc973e2031bb73f352d1063cc86db64208c8b52853d

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe
Size 176KB
Sample261012-3v8b2atsev
SHA256 52cc81731e98a6d8b0811bc973e2031bb73f352d1063cc86db64208c8b52853d
MD5 8708170f166417003cbdc4709f924e8b
SHA1 e64127359792d80d70bd37e66e2873ef48e63fd3
SHA512 80ce9f8f2351bb82148f54cc89b30ca0f174c7592965f6cbf0b99c61c32554d8ed7d5ebeb76bbf3b3720c624030d0f90874d73c269cd36afbf5bffebe0d8521a
SSDEEP 3072:r1dlKwgj23+Oz05YoNozGrvGAqRgYxgg9ZUACKSeN+17kd8:r1dlZro5yMlkxgg9ZFSq+175
TLSH
T14204D086B9C2817EC4B0053254B18FB94F3EBDF0162A4D83BF19FD1B2DB1594AB06B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4828	crypted.exe
1164	Bye Bye Yahoo!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	4828	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bye Bye Yahoo!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1164	Bye Bye Yahoo!.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4828	4052	jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe	89
PID 4052 wrote to memory of 1164	4052	jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Bifrose.bgn.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Extracted\crypted.exe
  "C:\Extracted\crypted.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 268
    3⤵
    - Program crash
    PID:3228
- C:\Extracted\Bye Bye Yahoo!.exe
  "C:\Extracted\Bye Bye Yahoo!.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4828 -ip 4828
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bye Bye Yahoo!.exe

Path C:\Extracted\Bye Bye Yahoo!.exe
Size 120KB
SHA256 0862505b956d20926c710293a5b54d63f545d3bcdb31011a3930d64e1be7d608
MD5 112bb68b8c31128e3ab1d71c5d635543
SHA1 3993b5862d20271ad482bf39dc8b4584734562f2
SHA512 a98f90cd0f0afb5083611b3be1790ab15220243a0169d5dd6fb328630c6f637fb000f41e965405b0f20a428bef3d17116e3567140d57c33843cb2ae87d83ae12
SSDEEP 1536:oDBpT1k6EWb2ySHwDJ+VMjb8vqG6+r31Fc1FL7Z:oDTYWbR+ukWF
TLSH
T1F3C3931376649D02F1D10271F825D2952126BDF1F923BE77388DBDC83B71A829DA6B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypted.exe

Path C:\Extracted\crypted.exe
Size 74KB
SHA256 82dda419a5df43072d10236bbf6663ddc2dbd9711a1bd8acac66a02c678a2f4e
MD5 c9d3fa4888024ead55f0c9adffe23ca1
SHA1 78e7a482068ae095001d66c08cb796ebef2780c3
SHA512 ba7ca8786d452cec8b58785d1c5070c9bd8a14974d38882ceb6003d4165725b15b6890cbd32fdd5c830fe1b23228ccde1de565840d63639d8d19dd856b4a8516
SSDEEP 1536:B8z32EO22L40sRzKU4rcpHHK5c+LOc3xuR7aus+Un6+:B+mEO22L4XgYxIg9ZUn/
TLSH
T13B73E053B90CC432EAAD03720A3789A60C1BBDF15A114E4737957F1E1DB25A72EA1F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.ini

Path C:\Users\Admin\AppData\Local\Temp\sfx.ini
Size 220B
SHA256 ba331759d97672066a96b62153aecae4bcaa41e530f1f06d8866ab07465fb946
MD5 1d05d55e7bb1c91a1faf8731c99b085d
SHA1 77df7362f4430737fb83168bc98fc87eb4142a74
SHA512 75133a2b5d4a55c63fd075367057da78dec2afc54b8500db8b194d2afefae67d4bd386df77befa9e86c62e8485a2c37320ef5eece274236317efc3bd054f7d44
TLSH
T11FD0235DC1DFD0540BD545B04FF570101056D772F8051202FB2520CD7DA36D4C66D27D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads