a7d53e56004e7d4cd99860e9467de8967a26cefe1a401d032a749263f0e76f7f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Chifrax.d.exe
Size 636KB
Sample261018-2csceswshs
SHA256 a7d53e56004e7d4cd99860e9467de8967a26cefe1a401d032a749263f0e76f7f
MD5 1a2dfe14273069765ef019068033b0b2
SHA1 d8f4b05d009043384603c01a37c1f320836380ea
SHA512 4c7ec653a51a48df7af36a5a23b52e6a4b1cf32bcf2529764621db2731e7b23609194fef84b222875417ed4b2f3b387d7fbcff565cd5daa6cc9bb3eb3d9aee29
SSDEEP 12288:AywvkIWdaBWmB/5BUiUqoQD93jVuXjwY70VeCeRKHTmm9wn7j:AW5dbc/QiUM+XjwYweRUmb7j
TLSH
T1B0D42352E3B8726FD4F22272A17C27A5587EFC206B348397560169E9ADB36C0953C70F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2060	Shine106Installer.exe
4816	rundii32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Trojan.Win32.Chifrax.d.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Trapcode\Shine.aex	Shine106Installer.exe
File created	C:\Program Files (x86)\Trapcode\Shine.aex	Shine106Installer.exe
File created	C:\Program Files (x86)\uninst-shine.exe	Shine106Installer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Chifrax.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shine106Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundii32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2060	956	jaffacakes118_Trojan.Win32.Chifrax.d.exe	89
PID 956 wrote to memory of 4816	956	jaffacakes118_Trojan.Win32.Chifrax.d.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chifrax.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Chifrax.d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Shine106Installer.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Shine106Installer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rundii32.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rundii32.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Shine106Installer.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Shine106Installer.exe
Size 103KB
SHA256 e6023bfe4bae9d72742a5ea99193d43b9bf46eaf6c8ca1b175cff56af5a3a75d
MD5 82ea71755b6063b5ebe5c874248fcefa
SHA1 f7ae9ee4cc9828e6363f74658a39750f662e166e
SHA512 98b52713257163ab3d3fb2c7f758ed5ea89f7693de71d72bcdea8b510f6dc40affe45c82a52f560201afd805201660a68ef3a664283b01997c9e1001cf9ae280
SSDEEP 3072:yZWIqQ5hA6xp6Js3OBWYA5u0fI+/U4elPTbGYbaxT:yzqGhjHOpAjQ+/UlrbSt
TLSH
T1FFA3F1656720C06BEC6A4030463B9FBFBF97DD7345451B8B4B80B75AFC20686EDAD242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundii32.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rundii32.exe
Size 1.3MB
SHA256 bc919e979b6b2409d53dbf9ce5d5c18acc6e748787f70663c058b36b90eb94d6
MD5 3fe7d5d8b552f72714c895247705e1be
SHA1 abc32ce9cb8a7af135e5f7b43ebec0fd89885ac4
SHA512 931b9193d8f7dbb6fda3d3eede24b539d130506d1d74b357ddf1af52c0854d0d791381b21205c6fc4992cd549c321a8ea99c9249656924369012e02fc4cc8a2f
SSDEEP 24576:wejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkk+:weUDeyLZqcn3CA
TLSH
T169559F10F541C42DE19300F322AA1BFAAB79FF61562519D74354F8ED8BA5C623EB920F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads