359ccc90ba8792121954be25d7a8db01f6110fcd44bce38ed0715515cb9b1119

Analysis

max time kernel
39s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
jaffacakes118_Backdoor.Win32.Androm.juyk.exe
Size 956KB
Sample261012-3vfxsafe74
SHA256 359ccc90ba8792121954be25d7a8db01f6110fcd44bce38ed0715515cb9b1119
MD5 1de2c0cfe9036b094b30ee2aa7925f4f
SHA1 f5d85bbe9f98bb9444f76478867a2e90cfe9e7b8
SHA512 7f4c9cb6ca437db6cc5cec3f10ad795a79b43e27ba1be97fe1634b5d69ea04ee1ef719e29af4bd58dcaa13ccaf32aa46c43a2e5db6a5aa28b2a90ea273b02c32
SSDEEP 24576:cM/jpTa/blI0SMYU+aJ2Pb9U9rJfeQ6QPfnnSXr:cwupIJZkJ2PbG1JfSgvo
TLSH
T19C25333882FD4794F5DFCF38302D682DE1E24E8198D4D0A75CF2A91DA0A2F5B867159D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	jaffacakes118_Backdoor.Win32.Androm.juyk.exe

Executes dropped EXE 2 IoCs

pid	Process
2284	file0.exe
4932	file1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Display Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AtiDisplayDriver.exe"	jaffacakes118_Backdoor.Win32.Androm.juyk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file1.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "117"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4932	file1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4816	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 2284	5024	jaffacakes118_Backdoor.Win32.Androm.juyk.exe	89
PID 5024 wrote to memory of 4932	5024	jaffacakes118_Backdoor.Win32.Androm.juyk.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Androm.juyk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Androm.juyk.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\file0.exe
  "C:\Users\Admin\AppData\Local\Temp\file0.exe"
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Users\Admin\AppData\Local\Temp\file1.exe
  "C:\Users\Admin\AppData\Local\Temp\file1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4932

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3954855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file0.exe

Path C:\Users\Admin\AppData\Local\Temp\file0.exe
Size 396KB
SHA256 4bc09a2e3f17c52861451f04fa11b54ab551d516028b094feee6e448abe1dbe1
MD5 3c0d0a5eb449ea5534bfd562653891ec
SHA1 dc7ca5a8c88919fe727001aa11eefb522dd6d212
SHA512 f0b25a52a7896b25b71b69e3c08916ec249b952ca1a160b51d50f192494b56b7fe0e7273d062f243fc1539618718d0d27d7498b9d6e314c70721db6293a5ea58
SSDEEP 12288:9fILdshLcfD2+EdiXAenUpvm3sE79o1oGm1lq+LgnY:h6shYL21iXAWUpvm1796f8Lkn
TLSH
T1DD84124DCBE0AD06E19C547480E0BB2D2675DE028B01FA477D6C47BF2645FC58EAB39A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file1.exe

Path C:\Users\Admin\AppData\Local\Temp\file1.exe
Size 542KB
SHA256 ece133283cf2e08521a43cf3147456c258f05e48ad9deecdac1ecd76dd4920f7
MD5 2c8ea9cf228684e7bdcc655a0cf89b0f
SHA1 6cf50714f1aadcd547060d4d74081b6a40c78d0f
SHA512 9ef44ac1a80eaf8deedf408a8e291beb60e6f8d17af9bf0ec3d4c0918201c1b3fc972a0c6b31c31d97cb2ea2f432e58d03dd9eb55c47823e9730117adb21ea10
SSDEEP 6144:7VyOetVJEZ7TL8GICoCuHyk+kI6u/pN39coBLnsZ+uioOFuQagqXY1KYiWPolHsK:7Vy52xTn2C8+L/p597zswFtBbmz
TLSH
T1FFC43B23E2A18473D1225B788D6B86A8D8A2FD113F24DE4E37F57E0C5F39741362A167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-27-0x000000001BFC0000-0x000000001C48E000-memory.dmp

Download

memory/2284-28-0x00000000013A0000-0x00000000013F7000-memory.dmp

Download

memory/4932-34-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4932-33-0x000000000046B000-0x000000000046C000-memory.dmp

Download

memory/4932-35-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4932-36-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4932-37-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/4932-39-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/5024-15-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-26-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-3-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-1-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-30-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-31-0x00007FFBE1950000-0x00007FFBE22F1000-memory.dmp

Download

memory/5024-0-0x00007FFBE1C05000-0x00007FFBE1C06000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads