d8bd680e6874934dc7bde0fbd94ce838c5cadaf0dcc5af5752db27d998e9a483

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 124KB
Sample261014-a8gf9ady2x
SHA256 d8bd680e6874934dc7bde0fbd94ce838c5cadaf0dcc5af5752db27d998e9a483
MD5 2d6b91d0c44c39909e973edb107e7b09
SHA1 d1c6187f59af9db465b33df7358f2677e5e04fe5
SHA512 ea41005957a18ccccf34803e34d0f6935204fc78044600a2bd5e30b727e2ddb328708458a9251895a691c8ee9eaa020333652c53761020d062155e47adec6def
SSDEEP 1536:wHVwy/aXw33eaFLxjDUPj/wWucl7dwJUFqWfpDK4CoNlklOq9ZOIu70uX2itw+nQ:L60exPChZwJIq4ElOq+IypGitwWYD
TLSH
T194C3BE597FFD272BC26CBBFAE0E2635013B8A161E353E3E50C5414F90D677A058642AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	winuper.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	winuper.exe

Executes dropped EXE 6 IoCs

pid	Process
4256	syshost.exe
1304	winuper.exe
1164	svchost.exe
2828	syshost.exe
5856	winuper.exe
3940	svchost.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\syshost.exe"	syshost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\syshost.exe"	syshost.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 1164	1304	winuper.exe	97
PID 5856 set thread context of 3940	5856	winuper.exe	101

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1164-24-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\syshost.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winuper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	syshost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winuper.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\syshost.exe:ZONE.identifier	cmd.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 248	4548	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 248 wrote to memory of 4176	248	vbc.exe	92
PID 4548 wrote to memory of 5340	4548	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	93
PID 4548 wrote to memory of 4256	4548	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	95
PID 4256 wrote to memory of 1304	4256	syshost.exe	96
PID 1304 wrote to memory of 1164	1304	winuper.exe	97
PID 1304 wrote to memory of 1164	1304	winuper.exe	97
PID 1304 wrote to memory of 1164	1304	winuper.exe	97
PID 1304 wrote to memory of 1164	1304	winuper.exe	97
PID 2828 wrote to memory of 5856	2828	syshost.exe	100
PID 5856 wrote to memory of 3940	5856	winuper.exe	101
PID 5856 wrote to memory of 3940	5856	winuper.exe	101
PID 5856 wrote to memory of 3940	5856	winuper.exe	101
PID 5856 wrote to memory of 3940	5856	winuper.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kaqvntok.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCE115712470743B387A9923A916FECF5.TMP"
    3⤵
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\syshost.exe
  "C:\Users\Admin\AppData\Local\Temp\syshost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Users\Admin\AppData\Local\Temp\winuper.exe
    C:\Users\Admin\AppData\Local\Temp\winuper.exe
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\svchost.exe
      4⤵
      Executes dropped EXE
      PID:1164

C:\Users\Admin\AppData\Local\Temp\syshost.exe
C:\Users\Admin\AppData\Local\Temp\syshost.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\winuper.exe
  C:\Users\Admin\AppData\Local\Temp\winuper.exe
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\svchost.exe
    3⤵
    - Executes dropped EXE
    PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES21D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES21D1.tmp
Size 1KB
SHA256 96f1379e502e426d6be036f4f069f38f14b1df89a80e488e29b7dfa60d066d79
MD5 c05ce613518ed22fdbdcb0c6fb5435b1
SHA1 117f883cae612ca704b64896f42a7b5bb6948c76
SHA512 b765ec4226130fd5ccbd1fb55d3437423f8eca16fe9c604282d8591fb31f5f752ab933ec5f3f00a5be4cf0ed3a3cce62439a688c7c8f0e1ca9ca28d4ee8ac182
TLSH
T18A21270553E8470EF0764B3265F6131B9279FD90DEA6A35E8590431E2C52550EEB1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

kaqvntok.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kaqvntok.0.vb
Size 409B
SHA256 f4e46da8398c8161d4f5d780060782a14339ae32fba141013628bb65d086b7a0
MD5 4ff95205b884bff6b2da4dedbb6e2158
SHA1 90f16c24d0e46389a22b9057cbf4782aed11cadf
SHA512 5506a2b063e7dccbaa81f8cbc46f8dd3b0815b863e47abf0178ff352b28a5b867d40e202e0d2ec4bdc3df3159426d362302487334a3b270dad00f6a5df18ee91
TLSH
T168E02B52FB27909396A17D9AC8471431196A079736545EDD729C4370C52F2C8C3B89ED
MD5 SHA1 SHA512 TLSH

Submit Download

kaqvntok.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kaqvntok.cmdline
Size 282B
SHA256 d01a00c8e0d450c35d0ec0d658bc59a33330d63dbb707a738233c6b3c18c10e9
MD5 d3ac137c1897aaa105abd0f4b0ac20d3
SHA1 dab473248f21e876d31aeb937b8843081452b586
SHA512 742d992eb9827dc02e4dc79ab7cc0df691a8d635a5026318621c51d5afc14920315071c7c14b371c714aabf2525edef92b90afba9729690077e2c88afe54f55f
TLSH
T113D02B3A02BBCF9C5418100F08FAD5DC42B3491734CE7FE499904888935B09D77D9716
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 1.1MB
SHA256 ff6444089af3ad4d14aa977a689b2786245848ca588018342561d44270d23542
MD5 6e9bf100272097f3e330e7c1f312c303
SHA1 33464583d801d2fd52181a98dcc411464a89007f
SHA512 65dc52dfabd74c2453e499f17b7337f157f7627240b3d76ea3f55cc60c32fdcb79fa6a2590cb04aebc0fc6b69a21457d8bce7dde2083cbb72e3b0ab35ee9dc39
SSDEEP 24576:e6DXzo5KsJf3QBtN8zC1DruG8myZzP760dDQZD:/zo5KmI/h3QmCT760WZD
TLSH
T1BE453A21A7E9412AF5F33B305CBA736449BEBD3A9E35D38E2294940D5D71E80AC64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syshost.exe

Path C:\Users\Admin\AppData\Local\Temp\syshost.exe
Size 6KB
SHA256 8be663f57095cfbc5364515efe492645602354aa7f1336006ee36e0805b46d60
MD5 80023230e69786f2d238b4300ce36e17
SHA1 ee1da61053ecb51a647f8dcc4de070dfc67234c3
SHA512 8ce4a0e9238cde2009fcecdfeedb773d1f9f984fc6765857b42c93f54e39bb42cab233691a2e842a097e840781eb7cf5fd7fa955a291031b93990d4cf274d8f4
SSDEEP 96:msLiieo6MujChkMqbZJN2y2IKfG5cE2iYlnlYJnLLPL0KffvrgvX6Lv19RXmmdWx:msLiiv6Oq3vOVrnlYJLLLTBC
TLSH
T1CFD1D62557E582B2CB7707734DA312405BB2EA449F7BFB6F08549372C8972490BB2B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syshost.exe:ZONE.identifier

Path C:\Users\Admin\AppData\Local\Temp\syshost.exe:ZONE.identifier
Size 27B
SHA256 f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e
MD5 130a75a932a2fe57bfea6a65b88da8f6
SHA1 b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c
SHA512 6cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed
MD5 SHA1 SHA512

Submit Download

vbcCE115712470743B387A9923A916FECF5.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbcCE115712470743B387A9923A916FECF5.TMP
Size 644B
SHA256 0b967aac9c131c4b91153a427ba445474b3947619c4ec2783d81db3fed646e65
MD5 4f8bcd6bbee4ce68c276a906343677a9
SHA1 7e9ba9d96ee307ab231a25e8bd2544ecbbf0715b
SHA512 6688d05e38ef58c3e14fbb332464de42a75f618ee4cefe30a0e0c3cbbf6077390a3846254645b5edacaac1b6560d57e151b60680f162b4a7f7faa4fdc792ab9b
TLSH
T1C2F05E1963F8520EF1F34F70B9F68363A0A9BC90DD3693ED5990030E2825520D972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

winuper.exe

Path C:\Users\Admin\AppData\Local\Temp\winuper.exe
Size 124KB
SHA256 d8bd680e6874934dc7bde0fbd94ce838c5cadaf0dcc5af5752db27d998e9a483
MD5 2d6b91d0c44c39909e973edb107e7b09
SHA1 d1c6187f59af9db465b33df7358f2677e5e04fe5
SHA512 ea41005957a18ccccf34803e34d0f6935204fc78044600a2bd5e30b727e2ddb328708458a9251895a691c8ee9eaa020333652c53761020d062155e47adec6def
SSDEEP 1536:wHVwy/aXw33eaFLxjDUPj/wWucl7dwJUFqWfpDK4CoNlklOq9ZOIu70uX2itw+nQ:L60exPChZwJIq4ElOq+IypGitwWYD
TLSH
T194C3BE597FFD272BC26CBBFAE0E2635013B8A161E353E3E50C5414F90D677A058642AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-15-0x0000000074770000-0x0000000074D91000-memory.dmp

Download

memory/248-7-0x0000000074770000-0x0000000074D91000-memory.dmp

Download

memory/1164-24-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4256-20-0x0000000074770000-0x0000000074D91000-memory.dmp

Download

memory/4256-21-0x0000000074770000-0x0000000074D91000-memory.dmp

Download

memory/4256-26-0x0000000074770000-0x0000000074D91000-memory.dmp

Download

memory/4548-0-0x0000000001280000-0x0000000001290000-memory.dmp

Download

memory/4548-1-0x0000000074772000-0x0000000074774000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads