f29646127abaf67a48f15f209812ff9e3a8d5d8976edfcaab56c9c611560dbb7

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.adstd.exe
Size 431KB
Sample261018-wpedfaca79
SHA256 f29646127abaf67a48f15f209812ff9e3a8d5d8976edfcaab56c9c611560dbb7
MD5 aae004f7758c24cca4ea5be510381d6e
SHA1 23546bef40848874719711bff5dde39ca65a15c8
SHA512 b40c0c4842803dc6586f4094e33f1124154cf9612841f79cfcade90f2cc36c21d2c80cbec626986e4f4c87987420fb672c8da8daada65e813643a29b5f68bb8f
SSDEEP 12288:hxaVAh64U5lToZUPvkHUO0FuvTIV65Ho6RIFGUc0iblbaA:hxaVxr59oMo7VvsV65NqFGllbD
TLSH
T12694021237D730BFE2A276304DBA266696B1FC395629ED0DFF91060E3E526428512B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence upx

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2428	rundll32.exe
2428	rundll32.exe
2616	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\IpuKOWvc91 = "C:\\IpuKOWvc91IpuKOWvc91\\IpuKOWvc91.vbs"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\IpuKOWvc91 = "C:\\IpuKOWvc91IpuKOWvc91\\IpuKOWvc91.vbs"	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4056	WScript.exe
668	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 2444	2616	rundll32.exe	105

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2444-23-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3084	cmd.exe
4168	cmd.exe
5420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.adstd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5420	cmd.exe
4740	PING.EXE
3084	cmd.exe
4168	cmd.exe
5208	PING.EXE
772	PING.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings	jaffacakes118_Trojan.Win32.Inject.adstd.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5208	PING.EXE
772	PING.EXE
4740	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2428	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe
2616	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4056	4176	jaffacakes118_Trojan.Win32.Inject.adstd.exe	89
PID 4056 wrote to memory of 2428	4056	WScript.exe	90
PID 2428 wrote to memory of 3084	2428	rundll32.exe	91
PID 2428 wrote to memory of 4168	2428	rundll32.exe	93
PID 3084 wrote to memory of 5208	3084	cmd.exe	95
PID 4168 wrote to memory of 772	4168	cmd.exe	96
PID 3084 wrote to memory of 1088	3084	cmd.exe	97
PID 668 wrote to memory of 1104	668	WScript.exe	100
PID 1104 wrote to memory of 2616	1104	rundll32.exe	101
PID 2616 wrote to memory of 5420	2616	rundll32.exe	102
PID 5420 wrote to memory of 4740	5420	cmd.exe	104
PID 2616 wrote to memory of 2444	2616	rundll32.exe	105
PID 2616 wrote to memory of 2444	2616	rundll32.exe	105
PID 5420 wrote to memory of 1796	5420	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.adstd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.adstd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\IpuKOWvc91\Ow2u9y.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" 7osi.dll activg6
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v IpuKOWvc91 /t REG_SZ /d "C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:3084
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5208
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v IpuKOWvc91 /t REG_SZ /d "C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && copy /Y "C:\Users\Admin\IpuKOWvc91\x" C:\IpuKOWvc91IpuKOWvc91\x && copy /Y "C:\Users\Admin\IpuKOWvc91\7osi.dll" C:\IpuKOWvc91IpuKOWvc91\7osi.dll
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:772

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\System32\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\IpuKOWvc91IpuKOWvc91\7osi.dll activg6
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\IpuKOWvc91IpuKOWvc91\7osi.dll activg6
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 && reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v IpuKOWvc91 /t REG_SZ /d "C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:5420
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4740
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v IpuKOWvc91 /t REG_SZ /d "C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1796
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe"
      4⤵
      PID:2444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IpuKOWvc91.vbs

Path C:\IpuKOWvc91IpuKOWvc91\IpuKOWvc91.vbs
Size 190B
SHA256 472faf3dcb6ea07b63e5e8cf4c9b84d3d97de890bab23f2c5e91535c79f88f4f
MD5 dba9434046df1cbd12f85bb07a33f20d
SHA1 cdf8685c49ccb29d6a86d230084ab1e4e04e5981
SHA512 8c94d500162b4be6f0982b94da3bc1134ca64b007028b04114d104dcb1f2c82508a314cbdd6ad366113da7f1ad91b4799fba92512e12891ec5af082e49258920
TLSH
T1CEC01243CE648256926579B9550818B6DD19C2BC146C55AD9A40C0B9ABF53101B4224A
MD5 SHA1 SHA512 TLSH

Submit Download

7osi.dll

Path C:\Users\Admin\IpuKOWvc91\7osi.dll
Size 10.8MB
SHA256 0ea9b97b5e0856292df7a9ff0d24b48b8aac11d349a24ed128a972ee4acb0033
MD5 2fcba4c087198afa21b25e933987b0fd
SHA1 a4355b0e043f6f401ebafe2f931f79c08fca30e7
SHA512 daf59c1364f0e7fb3c3013bc9be05e3ff1798f6fd9fbc9edf3f6c659bf38f61f20212ff721e750510fd37aa5d9c8bdddad5e2417afe474fd115ade9e44147482
SSDEEP 6144:eLsA9pzvj2t2Q/9O4X4W0E+UaoqFcGW5biogmBa1GMnkIDWEbMszADd:a9Bvj2t51CW0V5u5GIoPFDXbMmA5
TLSH
T154B67D37F6C08477D2772A7C9D5F97A8A829BF502D2824462BE81E8C4F3D7817539293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ow2u9y.vbs

Path C:\Users\Admin\IpuKOWvc91\Ow2u9y.vbs
Size 106B
SHA256 c3711cdcceeb0b76ba9dca882b8740123abb0453cbbab9abc1baf8fa495f0ce6
MD5 c717c91a2e0fa6ee9f7d61f51ecc9b8b
SHA1 ed930f37008288f1f480d95b0f0a2433b5103798
SHA512 a13874f065069c657983f0178ddffb3b19f5c204bce877e72668b1c2169a3557512b24f469e259598c30fc1e3ac299e890d771fd954598580ac06b5e4ce4eac3
TLSH
T185B012470628C1E5469E52F2101C41D9D116D7EC1C6854497F82C078A6E039903D770F
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\IpuKOWvc91\x
Size 1.4MB
SHA256 b6fd977d20b5b3cefa108bf56c50dec29e687aa3de0908143b766d240b63c61f
MD5 38b7437bbaec65a1cb2f16c5ad272b51
SHA1 f18a350ca6fe60cb590feaa463f8b90651fc1097
SHA512 a7214660d6024335d8decea55f51b2b1101b01c081f262862cac658fc4652e026b52d0e229a3f872f6bacaafccfe8b925204b5b36b0565134e615bc8ad11a7e6
SSDEEP 24576:ccpMgmgcpMgmgcpMgmgcpMgmgcpMgmgcpMgmgcpMgmgcpMgmgcpMgmd:ccXmgcXmgcXmgcXmgcXmgcXmgcXmgcXJ
TLSH
T12065F19E211CD5B1A1401633A58332F8598B1EE29DFACD67557036CDCAFCED0A5A3A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2428-15-0x0000000000AF0000-0x0000000000B4F000-memory.dmp

Download

memory/2428-17-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2428-19-0x0000000000AF0000-0x0000000000B4F000-memory.dmp

Download

memory/2428-20-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2444-23-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2616-26-0x0000000000400000-0x000000000045F000-memory.dmp

Download