20a3885e5a094154adeecc3af9666ff7c498846ef5ab3cf2d76fbce98f611d31

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.RAR.Starter.d.exe
Size 296KB
Sample261014-l2gdfsfe76
SHA256 20a3885e5a094154adeecc3af9666ff7c498846ef5ab3cf2d76fbce98f611d31
MD5 c39c6bf15c9ac939e0cc11b858ff0825
SHA1 1328a71f785c65414d8ff1aa6fec2d6a7373947a
SHA512 acf0f63ee6c8483bfdb51fb126438191826bfa439d9f2db1b6db26f91b7bbc38dfdde5e5a187ed3a394e5d773dff230b2f3d0596e7b8932edb2996c248cd7b7a
SSDEEP 6144:76YajbofxCv3jcekLxyaxU1cGoTNAawFtShFef1MiJiBY1FbX7du:dWPjcDvxU1CNAaMtShFeaYiWjrw
TLSH
T14B540221F7C281F2E0450330687E95B7B639BA667A34958B93C85D2F6CF51D2E81C3B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c557-21.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
4120	rinst.exe
3424	Ventanas_MSN.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32.exe	rinst.exe
File created	C:\Windows\SysWOW64\rundll32hk.dll	rinst.exe
File created	C:\Windows\SysWOW64\inst.dat	rinst.exe
File created	C:\Windows\SysWOW64\rinst.exe	rinst.exe
File created	C:\Windows\SysWOW64\pk.bin	rinst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.RAR.Starter.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rinst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ventanas_MSN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4120	rinst.exe
4120	rinst.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3424	Ventanas_MSN.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3424	Ventanas_MSN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	Ventanas_MSN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 4120	4816	jaffacakes118_Trojan.RAR.Starter.d.exe	90
PID 4120 wrote to memory of 3424	4120	rinst.exe	91
PID 4120 wrote to memory of 2876	4120	rinst.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.RAR.Starter.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.RAR.Starter.d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ventanas_MSN.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ventanas_MSN.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3424
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ventanas_MSN.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ventanas_MSN.exe
Size 30KB
SHA256 df360deca85cb86e6aef88c9472397ac96317b67151e219e940d09a4026c5072
MD5 e3b337848a3c627279cc071b075b85ac
SHA1 7d46fced11b78ec1a07442dd141a25c087ab60e5
SHA512 954a96d3cfd503230ca1dc2eebd8e5ca3b439000a310d938ce4648adacdb80ed8ab254e77e4456abc46e9b73d94edcdef4e33e70f54ee2886883db4366cbea48
SSDEEP 768:CBqO6Qu8b3Xt4yFAp3qS9lQ06Wawv3GHxfdeVrK0j:CEurH+aD06XwPmeK0j
TLSH
T114D2D0633FCA40F8C9D70EBA60276743B296BD2443224279E6E2C42AFC10515DAAD7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inst.dat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\inst.dat
Size 1KB
SHA256 9e6cbff8fa668a029606a7e992b1fb3ae7abe48e6b8205938b644e5217b44370
MD5 aeea50c7c2433323b9b5deca64ff3f5b
SHA1 4b2be352a876b79e47929ec836e687bf9d9c1732
SHA512 476764554cef4d3b26c3bbe6cec5d0c2b8d390302ba45bc3d74a0cd2b84464c3f5cf9844122e37cc78a3c903689ae7c8b0d10cda437e921f98681aa36a6a9465
TLSH
T15E21B6461BDA0716FAB3EA707DF4DD1248693C25E936C75C85805E1D0C32759AD60F22
MD5 SHA1 SHA512 TLSH

Submit Download

pk.bin

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pk.bin
Size 7KB
SHA256 212ea57c2ee8ba022c2f9144ab7d89d9f28710f38570b5a3f313ef9e16304442
MD5 d6de34af82225896432e9938c3919887
SHA1 c807d08d35ec4ff7bf09d923de77b9b96b32c5fa
SHA512 cc3505fe29d3edbd4cc0e1b5f20811cf98d6e415f4bd404530fba00b89629b401781c2456e85fd8e9e6ecae9ae37fc2fbd08dde14862fd05e2340e5149b3f579
SSDEEP 12:eRnFwh0ltVVlUE49OEx4Xk4zG6cjwiQVo/MDiaUuYgVtslLn:rh0YAE6U4zV1ZxO5uYjx
TLSH
T1B3F15978A2A560D0E40F43A532F0BB3870063A07DDD5F180676EC1520D31DE84D4CC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rinst.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe
Size 22KB
SHA256 98d257f639ee9df968f77b1f66c78230d07d86e58a7ddf0d306a24af3873dc5b
MD5 9a00d512f9e1464ad793702cf2b1eda0
SHA1 39a47a90cd3dd132dbab9f5052dda38dbd7c63f6
SHA512 18604f20351db1d418f48f2eb023be07588754b428b5d6abb0a7c40d6bf174ce7dcab2ae6e06f22585e12f1bfdb6e408b17bf20e2a7ba137620002ac04b8b4ba
SSDEEP 384:c3PqIGR1uEtfWlXdbvoht0zsQHmr246v1hLqsHWuTqvhwp:aqZv3tfEbgIzsQHs6v1hLqQ9q
TLSH
T15FA2A4563FE70735F3B3CB306574EB12896AB9A2E853CB4DC4D21F090523A5699F0E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rundll32.exe
Size 408KB
SHA256 136e0c4915fd7af5d95e05ff8d30d82f31d0b7ad3a40cef08d56a9b9924c3615
MD5 48edfb7e461533358ea3994f7348b95c
SHA1 43f44347294afdfe85a6440af22e165b14fe1cfb
SHA512 0aed5813b2800bdaecc3c6b47a580aaa3575a86733ad50ac8734d6e93fa85874da0404a8b6cc16ee30f179b1a2e31e011571aad736ab752c3fa58080db39aff4
SSDEEP 6144:TArbsY5OVe+t5Cj5ud7njw15qTs6bopobCm3KPviX+uXReQFwe:SsY5Okw5C5uxjE5EsJpRviX+uvH
TLSH
T196944A84F5AF5F333FB13CF8368A336A8423D0706D6E2686715568AE29798E405C57F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32hk.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\rundll32hk.dll
Size 21KB
SHA256 e20750f97f545cacbdf6f849f700a4f299a0bccef632174d58389bfdfeee37b2
MD5 90154bf867408c8859cc3046c683e99d
SHA1 b29c7af7ebdb34c33e6c12e3e1dd87a527ca5e95
SHA512 1379e2213a21d96c65a0ab75ff1a504d8f4592a449af1963245b23d692249d914a30bc34c288e5911274fe7c053dcf4ea57e938190bf98a28a588823ae059c58
SSDEEP 384:HhcVfJ3HKQ+711RL9Gd7YzSMYC5TIwzu789q6:BcVh3KQ+711RjuvC5cwzu7891
TLSH
T17DA219F3E0CBD5F249D164BAB899BA8B1411F130ECD7275472109690BAB68A7394D3F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3424-30-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/3424-34-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4816-33-0x0000000000400000-0x000000000041C000-memory.dmp

Download