f22dbd7f5e499e13bdcf0e479ea8f0671e9a0c1a5b6d33695edbb816ed6aef85

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe
Size 29KB
Sample261014-k77bdsay2w
SHA256 f22dbd7f5e499e13bdcf0e479ea8f0671e9a0c1a5b6d33695edbb816ed6aef85
MD5 4ccccdf059d8e2de4622d7886ea021b1
SHA1 7dd772f0d5ab1ba74a42b715758d9b566d7d8ba6
SHA512 a7eda78b9abb993bf7a2a72a67f33ad4385a3d9883a41c616d1b6f4e8324c5749edd69953a560fd9c6b24809294abb60b795d45086debc2902b32f5742d1b8c8
SSDEEP 768:sCUi7+nN5ozDpwkR5QxiC29+gsf1V6ee:9UiSnN54ppRci19g
TLSH
T184D2E094BE1C80A2D8D97D31BB2660B24512F9B202D1C778CD3C6BA361B4798CB1DF47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution spyware

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c4f9-40.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
3508	fial.exe

Loads dropped DLL 1 IoCs

pid	Process
3508	fial.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\crt32_v2.dll	fial.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2764	cmd.exe
4284	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions	fial.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{869EE607-5376-486d-8DAC-EDC8E239AD5F}	fial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{869EE607-5376-486d-8DAC-EDC8E239AD5F}\clsid = "{869EE607-5376-486d-8DAC-EDC8E239AD5F}"	fial.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Extensions	fial.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Extensions\{869EE607-5376-486d-8DAC-EDC8E239AD5F}	fial.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Extensions\{869EE607-5376-486d-8DAC-EDC8E239AD5F}\clsid = "{869EE607-5376-486d-8DAC-EDC8E239AD5F}"	fial.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{869EE607-5376-486d-8DAC-EDC8E239AD5F}\InprocServer32	fial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{869EE607-5376-486d-8DAC-EDC8E239AD5F}\InprocServer32\ = "C:\\Windows\\SysWow64\\crt32_v2.dll"	fial.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C0MCTL.S1ider	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{869EE607-5376-486d-8DAC-EDC8E239AD5F}	fial.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 3508	5072	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe	90
PID 5072 wrote to memory of 2764	5072	jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe	91
PID 3508 wrote to memory of 4284	3508	fial.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.gf.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\fial.exe
  "C:\Users\Admin\AppData\Local\Temp\fial.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\elal.bat "C:\Users\Admin\AppData\Local\Temp\fial.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "c:\cmdB094.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elal.bat

Path C:\Users\Admin\AppData\Local\Temp\elal.bat
Size 70B
SHA256 2d8efe1526fa203539bc77da8570b4cb38d5a63836a76d2379b7b506d0a67ee0
MD5 677931564938373367422e56cdf23934
SHA1 fb077020992d9fa49a901d3b64c3d9ce5bb88b35
SHA512 808e177716911a5b975449b55df4fe1fc97cdb929be621fe541a7dfe7dce3362039214fe1ab4760c4d67aafe8a12308d04e5a40dc028b848c154f3e3f2d120ba
TLSH
T19BA022F080808388AC382A38882F038CF30C80C380000C2AB82300E0F2A23A3830AE82
MD5 SHA1 SHA512 TLSH

Submit Download

fial.exe

Path C:\Users\Admin\AppData\Local\Temp\fial.exe
Size 24KB
SHA256 fa9a2b8ae14232247c258d2c9155f5a0977cfd07f529a991200aaabe05b8b334
MD5 b0052adc506d404d9be115d66f7cbb9e
SHA1 58fec2e5a23008a09bcf1c212c5cf7abc8361821
SHA512 6ceead8a321a361e75320d38798298b41411a37b955ce57f7f2920eb7ece13be9e3ddc84ddcaf3eee5fa805f056707b19a3233e7938d1737848063115bafdda6
SSDEEP 384:ynhWdWJeC9JexL67W/41tm9Jg1c2Ck0dXDAtsy7kqqt0NskML:WzeUW/41tAJD2C7XDMNDNs
TLSH
T172B2D0257D8054BADA50B031D7C65EF30B2AE1B45390D7CF0CBA5ACB76246FB8E34626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crt32_v2.dll

Path C:\Windows\SysWOW64\crt32_v2.dll
Size 19KB
SHA256 e63becc89acf9108ad79026d3bd72df5378e4f2181c70907c290a77b6c4e223a
MD5 69008cb4a15c21f779d43f4407808776
SHA1 22e5ee8fd7b8114d517dbc3595b486f31156972b
SHA512 52fcada3b66b145f75118d26bfa0482db521337af4b6f9dc3fc0b1976ee666bab2c59e12313336043fd611d14164797bae01765172ebc888e2ee974e43359e11
SSDEEP 384:0JexL67W/41tm9Jg1c2Ck0dXDAtsy7kqqt0NskML:UeUW/41tAJD2C7XDMNDNs
TLSH
T13A92C0643DC094A5EA04F070EBC2ABF30B07F5E452A0EB8D4D6CAEC7760826D4F5567A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdB094.bat

Path \??\c:\cmdB094.bat
Size 218B
SHA256 31f645101d974d007b8c7033fce99020b1beb03fff22a2e26baaa057904f91ef
MD5 8e6a9b2d464c35bed6e13ad6f1487242
SHA1 93ae6f77c89c69624d9474f8ce2c87e4caa5c421
SHA512 978340792c8f332dc67944c73d9f5bcad75328171e7722437f8c7bc5d2b3bcc6041c2d44b8a36062dcc30fd213d8888361d303f9d350dc0103f73f16e0d417ff
TLSH
T192D0A70C91D7494988C4C9770A79CB8EA0150E0A2A843F145332C88C62F1456634331C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3508-44-0x0000000010000000-0x0000000010011000-memory.dmp

Download

memory/3508-46-0x0000000010000000-0x0000000010011000-memory.dmp

Download

memory/5072-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5072-1-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5072-29-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads