Overview

overview

7

Static

static

3

jaffacakes...en.exe

windows10-2004-x64

7

jaffacakes...en.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_not-a-virus.HEUR.AdWare.Win32.ELEX.gen.exe
  • Size 3.4MB
  • Sample261014-e2d5rsf17k
  • SHA256 b8907843f5ea6bf864540c7d1cb877bd36a29c4dc84a44a2c448e3fface30d07
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoverypersistence

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 19 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.ELEX.gen.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.ELEX.gen.exe"
    1⤵
    • Checks BIOS information in registry
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Users\Admin\AppData\Local\Temp\app_00000000\uninstall.exe
      C:\Users\Admin\AppData\Local\Temp\app_00000000uninstall.exe -install "-su"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3368

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP110.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\MSVCP110.dll
        • Size 522KB
        • SHA256 c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SSLEAY32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\SSLEAY32.dll
        • Size 275KB
        • SHA256 9e60089134c9f30e29e424e28eccf03d462827f5b0e3e611c2006363cf33fc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        curlpp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\curlpp.dll
        • Size 610KB
        • SHA256 cfd9f0dc4ab62d6219646a2cdd3ca1e671e74df2d0274f3bf95446eed16470c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iImportLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\iImportLib.dll
        • Size 959KB
        • SHA256 6d536e29f14190ded266e5f09f4bbdb90bdba612d2453464ff3863d522ce286e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iSafeBase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\iSafeBase.dll
        • Size 1005KB
        • SHA256 185fc5cfffd52cf8caf314da446cedc4993056cd40ccf4139acf9a1116b5c1ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        isafemc.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\isafemc.dll
        • Size 31KB
        • SHA256 aba3d0e4c46337af1ed2fd9e10e8bd149f8a52310afb857f3799ea8334b9c987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        isafepxy.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\isafepxy.dll
        • Size 115KB
        • SHA256 b6fa8767f993769b0b4ea854f102f395c3e5a05607e68a50717806b32d87f171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        isaferpt.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\isaferpt.dll
        • Size 164KB
        • SHA256 b60a6df2a814f67b8b22ce1c8af6f9586c16f169e7a3476e7643b68d18faf00b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        YacVPN_uninstall_lang.xml
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\lang\YacVPN_uninstall_lang.xml
        • Size 15KB
        • SHA256 faf9a1c5803d83ade51dad5607963605dd8f63051cba512b7e3cab5c7d0ee8d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\libcurl.dll
        • Size 299KB
        • SHA256 c9ce30d58128b616a3cb65b014c1278d29df001d899da00032d844cbacff2611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libeay32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\libeay32.dll
        • Size 1.1MB
        • SHA256 85aeba0cec7f4bfe5e7ae291ab01fbbd40b2c0759dcd512dd5426f74f60f87b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\libpng.dll
        • Size 182KB
        • SHA256 6467987553355378f8750c21de1992ce3228238e58ad0bbc6728058f0318c352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\main
        • Size 10B
        • SHA256 93a623cae1477383dc5a3c66facdb5bd42ee5d42ab6ebc369a833ffc36286679
        • MD5 SHA1 SHA512
        Submit Download

        msvcr110.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\msvcr110.dll
        • Size 854KB
        • SHA256 b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ouilibx.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\ouilibx.dll
        • Size 1.8MB
        • SHA256 e0210ff762f0cb55994a6f7e1476f27a58a4a89989896e5ddd7437fcf5ace5e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_button_bk1.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_button_bk1.png
        • Size 17KB
        • SHA256 998fc2f8aea3971b37e35dafb324507661c94019178af15ef6faf9240e65ddae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_custom_uncheck.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_custom_uncheck.png
        • Size 275B
        • SHA256 5a7d88278fd879b62008d8acc6888dbbba11b991ef1055b9793e8ab2af75e4f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app_install_bk.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_install_bk.png
        • Size 163KB
        • SHA256 990432a5daa792f297a63ef4c7fb0df8e059e02b20cd13870879bfc313631453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_line.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_line.png
        • Size 291B
        • SHA256 95443e4b8c86a1eadaf2cf44cc844fb95a903121af69bd2e04930f8dad64267d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app_uninstall_close.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_uninstall_close.png
        • Size 17KB
        • SHA256 84dcf930f7a3322dd69c92265dc97a81aa23e1a60827e8d0d592589e664c4ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_uninstall_logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_uninstall_logo.png
        • Size 17KB
        • SHA256 1935b536298d95b5e6cbcbeba69ecd47cb38aac72aa86edd5b385aa896ba6655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_uninstall_text1.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\app_uninstall_text1.png
        • Size 15KB
        • SHA256 14665fdd58d5eb2799345acb13b96f4c2d0856765c6223c2d80868bba74f6611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        combo_list.png
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\combo_list.png
        • Size 17KB
        • SHA256 ea0579597cf60c90c0843292bacb96a05d8635af73c99a35a28074815722dbb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resource.xml
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\image\default\resource.xml
        • Size 5KB
        • SHA256 cb7f33012705b3e6b44c630afd1aa75fb00a17dc05afe67fff17eaec8b136549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.xml
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\layout\install.xml
        • Size 5KB
        • SHA256 d984acd871d5837985ed6cb2dd7338b94700b5119da9a15d869cb318d3d7c040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        style.xml
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\skin2\YacVPN_uninstall\style\style.xml
        • Size 3KB
        • SHA256 70150cb99fbde7e74bf68d87d59f4a6f4304f284c8e70606719aab9244603ea2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\sqlite3.dll
        • Size 392KB
        • SHA256 00a106879921192ce1fcbfd40ee33103e2f5490b3750fbae0bf31c16b8e14806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uninstall.exe
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\uninstall.exe
        • Size 383KB
        • SHA256 310e0de30f7e19002a98ec4fac47f0577906cc96824c9703201533f4c8f9c3fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\app_00000000\zlib1.dll
        • Size 65KB
        • SHA256 f99e39271347895b9bee3b064cbaf2a5ae06497ef53ad9a6262617a1c999971e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpn_install.log
        • Path C:\Users\Admin\AppData\Roaming\Elex-tech\YacVPN\log\vpn_install.log
        • Size 2KB
        • SHA256 0fc5a4687f205e88ade480c8524341731829ac569859f5f8ed076aa3d87fc542
        • MD5 SHA1 SHA512 TLSH
        Submit Download