f632af5f79b5221f7fe41a31bd016c5d43a72709c4638ddece284af0a3637492

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Tiny.c.exe
Size 64KB
Sample261018-24v8dsty4k
SHA256 f632af5f79b5221f7fe41a31bd016c5d43a72709c4638ddece284af0a3637492
MD5 e01ee1427693979284258c9d8c565f00
SHA1 f206f86f9ca124fcb86787f60e70841322549ef5
SHA512 6e8b4788ace9a12a071ac925729d46ebb24a2801e0a59c12be836502bc5dfd28ba8739fda700fe362aa62179c55a6d01ea53973ad67bc3fbebc9c4bbdff6939e
SSDEEP 768:V+jvg87BQ+J6XKm4YVuQP9z2R8YKhCsOz+Nsy9n:+VIf4YV1FaSez+ay9n
TLSH
T1FA5317233B1AD4C0D9A16630ED42D2FA1665BE17CA56436732D13F2FBB3B6C3481295B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}	1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7M8A6G00-3I18-11C0-821H-444200140P0S}\StubPath = "C:\\Windows\\system32\\OLE32Init.exe"	1.exe

Executes dropped EXE 4 IoCs

pid	Process
3296	1.exe
2520	2.exe
4308	fks2.0_server.exe
2536	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FKS v2.0 = "C:\\Windows\\system32\\fks2.0_server.exe"	fks2.0_server.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\OLE32Init.exe	1.exe
File created	C:\Windows\SysWOW64\OLE32Init.exe	1.exe
File created	C:\Windows\SysWOW64\fks2.0_server.exe	2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\regsvr32.exe	1.exe
File created	C:\Windows\regsvr32.exe	1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fks2.0_server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	regsvr32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3296	1176	jaffacakes118_Trojan-Spy.Win32.Tiny.c.exe	90
PID 1176 wrote to memory of 2520	1176	jaffacakes118_Trojan-Spy.Win32.Tiny.c.exe	91
PID 2520 wrote to memory of 4308	2520	2.exe	92
PID 3296 wrote to memory of 2536	3296	1.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Tiny.c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Tiny.c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\regsvr32.exe
    C:\Windows\regsvr32.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:2536
- C:\Users\Admin\AppData\Local\Temp\2.exe
  "C:\Users\Admin\AppData\Local\Temp\2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\fks2.0_server.exe
    C:\Windows\system32\fks2.0_server.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.exe

Path C:\Users\Admin\AppData\Local\Temp\1.exe
Size 45KB
SHA256 825a7f2db5426e9de74b8a3c9f089da828c16644ddd87de011c4068c0f5bef41
MD5 c4f29fa5595f9ba1625a60c80f1802c9
SHA1 39e33ccce26e2dd0dd17d009d7ddfb0780510fab
SHA512 0f283508353d370e339b2ab6bf8ca9c8dc40104becd146f24f0df468877c2bc2dd8bd76ac4d111552984b733505f1ae2aa043e01d12c02eaee7b0696a323e40a
SSDEEP 384:S/EbHAbkKF6XfCmfgYQxZcuQPEq14mvkIkRXMcTKeQfn7OV+JJ/DxJJWM7MYOq4t:SQ+J6XKm4YVuQP9z2R8YKhCsOz+NsN
TLSH
T16523B4223B16D4C0DD90A630EE46D6FA0665BE17CA5612A732D03F6FFB3B6C7481251B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.exe

Path C:\Users\Admin\AppData\Local\Temp\2.exe
Size 2KB
SHA256 1648c2cab7f9ad55fbd5c294200a67b2047809e64b529bd03f7fe855e2e45da6
MD5 86e4d5913712afdb0b209cffae7a5953
SHA1 86280ae98a7436df51eb7bcfaa2647c2f9ed3ae1
SHA512 f46339294ca068c5d45b5dbec69625b62e944ad0961de56c5f43933989ee8d113384ca2ecd762596cbf7bb940be37e59a9e4562e5ace5e5bce1f41ee56360305
TLSH
T1AD511B27B75CFFFBD1AD62323053B09B351910A1D6DED9832C88123739311A45676C96
MD5 SHA1 SHA512 TLSH

Submit Download

OLE32Init.exe

Path C:\Windows\SysWOW64\OLE32Init.exe
Size 45KB
SHA256 fa5b37261e137ff671e1b159c5c805916c99d532a9580ad4999c46e1b526f39b
MD5 b2c3e0df4a7c3c641d9b42f3b20cd438
SHA1 100cec6cee17fdd771043b4106761d54d22d8810
SHA512 0de786b33a2a9010296777dda23f6bb1bbef668ba00937f417d11c0eda2916c02650e661eb30dc671ff35cf3e8e24492870916c12f5dd6dbc412e83f8513b536
SSDEEP 384:K/EbHAbkKF6XfCmfgYQxZcuQPEq14mvkIkRXMcTKeQfn7OV+JJ/DxJJWM7MYOq4t:KQ+J6XKm4YVuQP9z2R8YKhCsOz+NsN
TLSH
T15D23B4223B16D4C0DD90A630EE46D6FA0665BE17CA5612A732D03F6FFB3B6C7481251B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-3-0x00007FF9F2D70000-0x00007FF9F37A8000-memory.dmp

Download

memory/1176-4-0x00007FF9F2D70000-0x00007FF9F37A8000-memory.dmp

Download

memory/1176-19-0x00007FF9F2D70000-0x00007FF9F37A8000-memory.dmp

Download

memory/1176-26-0x00007FF9F2D70000-0x00007FF9F37A8000-memory.dmp

Download

memory/1176-0-0x00007FF9F306A000-0x00007FF9F306B000-memory.dmp

Download

memory/2520-30-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2536-32-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2536-36-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3296-27-0x0000000000750000-0x0000000000752000-memory.dmp

Download

memory/3296-33-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3296-28-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4308-35-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4308-37-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4308-47-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4308-49-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4308-51-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads