9dba48b1120de5b3708d4b064e4b20f4fbc84e6f65a3cd638997e438ca1d1c57

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Packed.Win32.Black.d.exe
Size 721KB
Sample261014-j39ehsav3j
SHA256 9dba48b1120de5b3708d4b064e4b20f4fbc84e6f65a3cd638997e438ca1d1c57
MD5 ec97b027dca882d0f83dc0d595eda941
SHA1 82180a3b4b4a06b7b88bc11859bb8841b5e7cac7
SHA512 3669c89d875b5dd4ff11a7a3b94b289e1ce8aebc4301295e8eea73e86556dd12aca0cd92f3c36cf01bc6fdd29237be83302ba423598aa092ada73ae8731d34a8
SSDEEP 12288:7CcVB0+m5PVf72W6DF4ToIh7UnJDKeF3Z4mxxWQmd66OqZAgR8d+:E5PYW6DF4TohZQmXhCHy0
TLSH
T11DF4232E8AA12726E01612F4507792C2D7F3536317FE069A72DDED6B3A71FB07785006
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	1.exe

Executes dropped EXE 7 IoCs

pid	Process
396	1.exe
2268	Server_Setup.exe
3044	Server_Setup36XQ.exe
392	1.exe
2312	Server_SetuptUhG.exe
4864	Server_SetupQpol.exe
1820	G_Server2.03.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Packed.Win32.Black.d.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\program files\common files\microsoft shared\msinfo\Server_Setup.jpg	1.exe
File created	C:\program files\common files\microsoft shared\msinfo\Server_Setup36XQ.jpg	1.exe
File created	C:\program files\common files\microsoft shared\msinfo\Server_SetuptUhG.jpg	1.exe
File created	C:\program files\common files\microsoft shared\msinfo\Server_SetupQpol.jpg	1.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\G_Server2.03.exe	Server_Setup36XQ.exe
File opened for modification	C:\Windows\G_Server2.03.exe	Server_Setup36XQ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_SetuptUhG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G_Server2.03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Packed.Win32.Black.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_Setup36XQ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server_SetupQpol.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	Server_Setup36XQ.exe
Token: SeDebugPrivilege	2268	Server_Setup.exe
Token: SeDebugPrivilege	4864	Server_SetupQpol.exe
Token: SeDebugPrivilege	2312	Server_SetuptUhG.exe
Token: SeDebugPrivilege	1820	G_Server2.03.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	G_Server2.03.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 396	4532	jaffacakes118_Packed.Win32.Black.d.exe	85
PID 396 wrote to memory of 2268	396	1.exe	86
PID 396 wrote to memory of 3044	396	1.exe	87
PID 4532 wrote to memory of 392	4532	jaffacakes118_Packed.Win32.Black.d.exe	88
PID 392 wrote to memory of 2312	392	1.exe	90
PID 392 wrote to memory of 4864	392	1.exe	91
PID 1820 wrote to memory of 5772	1820	G_Server2.03.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Black.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Black.d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:396
- - C:\program files\common files\microsoft shared\msinfo\Server_Setup.exe
    "C:\program files\common files\microsoft shared\msinfo\Server_Setup.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- - C:\program files\common files\microsoft shared\msinfo\Server_Setup36XQ.exe
    "C:\program files\common files\microsoft shared\msinfo\Server_Setup36XQ.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\program files\common files\microsoft shared\msinfo\Server_SetuptUhG.exe
    "C:\program files\common files\microsoft shared\msinfo\Server_SetuptUhG.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- - C:\program files\common files\microsoft shared\msinfo\Server_SetupQpol.exe
    "C:\program files\common files\microsoft shared\msinfo\Server_SetupQpol.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864

C:\Windows\G_Server2.03.exe
C:\Windows\G_Server2.03.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Server_Setup.exe

Path C:\Program Files\Common Files\microsoft shared\MSInfo\Server_Setup.exe
Size 764KB
SHA256 e74cbb377ec0b65097f42b507fd15e7dabf82525da01f83fd7bfce1c9264b3f6
MD5 07dbc0ea22796a7daf542108a38f84dd
SHA1 7459082a07bd469f7f1256f3a35266302c5d2532
SHA512 c5b79e76fbc627849b2aec93427ee1a5250f29dddc357d4f98285936dc18cf59140c4b6d968d48da57e2c2039b6b2edc29492eefae9d8df70d2ac3381b09cf31
SSDEEP 12288:i6lg9NZK9jbrW5AwGwHDx1fKIWnxvVtO2tjvP5cU7MoShS/JXZPqLR:9+969/rW5AjixF+xvjO2tRWiZq
TLSH
T194F47D23F6919477D1732A38DC2B5355582ABF102E28A84B3BF81D5C9F397813D2A2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1.exe
Size 1.5MB
SHA256 3db549c83b11a8126c5a40c265d2b7b435b7d6bf5862e1bd8e5643ed3195b110
MD5 e0090a51472cb5da897528fcc1b8537c
SHA1 953061e0d72872cd302532f4695b8803c9d6be7e
SHA512 2c68d70cda530e0d744fd3144cc370ec25ba2851914f0e860d21e52785051ecdc8ee5bdeabc633517294d4a1b2ff646ec264f48f8ab47a8e259a8f52b87a5fd1
SSDEEP 12288:2/M5l4/Qeofenvz8I7YKDKQe3mJ+CC++1EpgIHh7BUIC+gjupjP8uoa3SwJM5l4t:203uof+oIJV5Yb3uof+oIJV5Y
TLSH
T14F759E01D6B62F57C05D9273F932CAF7826B7A05764EB0AF1015D2D268E31C607EA87B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-59-0x0000000000400000-0x000000000058A000-memory.dmp

Download

memory/396-34-0x0000000000400000-0x000000000058A000-memory.dmp

Download

memory/1820-76-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/1820-67-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/2268-41-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/2312-61-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/3044-66-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/4532-4-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-2-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-5-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-11-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-6-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-0-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-3-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-63-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4532-1-0x000000000106D000-0x000000000106E000-memory.dmp

Download

memory/4532-7-0x0000000001000000-0x00000000010C0000-memory.dmp

Download

memory/4864-62-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads