Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
- Size 3KB
- Sample261014-nlkr2scs2m
- SHA256 19c60b837eb4a0663b7d0f90476db83d830c9b5964de657588b7e7d444dc6912
- MD5 4791673a52205bbc663f2d3b7b0edd49
- SHA1 033a0c9d7d878c5743ce72360e43d406cd439b00
- SHA512 3a31b99930dd618da7cfa4be1598878388af3cccb2a584878d9e5a4a7e7dfa980b571cb810ad46ee520d2ec5900c5cc591760e5402168f3c2f27b6144ec3a2e4
- TLSH T19F6164878E5D6896E93D0AF10CCA55F422AF7371010FFB5EAE0084B5AE3B2766E20D40
- MD5 SHA1 SHA512 TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,tianya.exe" jaffacakes118_UDS.DangerousObject.Multi.Generic.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\tianya.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File opened for modification C:\Windows\SysWOW64\tianya.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\svchost.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File opened for modification C:\Windows\vnc.dll jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File created C:\Windows\vnc.dll jaffacakes118_UDS.DangerousObject.Multi.Generic.exe File created C:\Windows\svchost.exe jaffacakes118_UDS.DangerousObject.Multi.Generic.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\tianya.exe
- Size 1KB
- SHA256 80422bc3d307b4a25bdafcc84ac7fb01cb55a09810e8b0f37bb12e0edb5c48ca
- MD5 53e979547d8c2ea86560ac45de08ae25
- SHA1 53ea2cb716f312714685c92b6be27e419f8c746c
- SHA512 55e69acd206bb6666ba1947e841d83e67e02eae155d218944e5ae28b1f299da801cd6d522168155484ab8e6c037fc97df4b0a47bbcf3536b592e429c8346d7ba
- MD5 SHA1 SHA512
- Path C:\Windows\vnc.dll
- Size 80KB
- SHA256 4d43ceb719c2fb3808f0452ab768f27769e6925b944b3fb00939f3d7f976bc3f
- MD5 4b4022a8e21ad7552b10f59c547172a8
- SHA1 8ad167dd5db3ada49bb114effff8659b5e9fd72d
- SHA512 a7fe55cad6ec60515c217e006699d89dd666e012a5fb5ee4cfc74cd5f0e8a2fdf561a9e264c14beb0a3a18973f540d9e624c8f74c230413f688f62f19a0be7d6
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP