2bbb6f476b32c5afabd570306b1f7675b0c32348e9a4d624c07e569c58111ba3

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
Size 192KB
Sample261018-z4f3css12m
SHA256 2bbb6f476b32c5afabd570306b1f7675b0c32348e9a4d624c07e569c58111ba3
MD5 44011ceb23845d7661dee777d2b6b7de
SHA1 40a34e8483ad426acc332ab9e4d50e0a7f5e3078
SHA512 7e08c4d25581c3ca3ec1123481f374bfe4cee58e1fff016fffb3a42c46ca1ccb64d7ecbbbcd90b029081a1752a7835b4e505d0ed38c5443586c1e72da4bc6670
SSDEEP 3072:nbLpZuEskJoU4VQi1wX7hWleUuA+CEPkC8R3lno2TIrd4YWG/oIMysHkoSL:nbOO2h128Pzbbo2Tey4hFsEoSL
TLSH
T177141287B3D0D4F3D7430670CDBBCBA3E2F6660016946B835B659F7E5EB62A31926084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	01.exe

Executes dropped EXE 3 IoCs

pid	Process
1080	ns8A0E.tmp
4736	unrar.exe
3004	01.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
2544	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "kdgqn.exe"	01.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kdgqn.exe	01.exe
File opened for modification	C:\Windows\SysWOW64\kdgqn.exe	01.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2428	3004	01.exe	89

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4736-18-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/4736-23-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/files/0x000700000002447d-17.dat	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MovieBox\Uninstall.exe	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ns8A0E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo	01.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International	01.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MovieBox\CLSID	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MovieBox	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MovieBox\CLSID\ = "{6BF52A52-394A-11D3-B153-00C04F79FAA6}"	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3004	01.exe
3004	01.exe
3004	01.exe
3004	01.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3004	01.exe
Token: SeSecurityPrivilege	3004	01.exe
Token: SeTakeOwnershipPrivilege	3004	01.exe
Token: SeLoadDriverPrivilege	3004	01.exe
Token: SeSystemProfilePrivilege	3004	01.exe
Token: SeSystemtimePrivilege	3004	01.exe
Token: SeProfSingleProcessPrivilege	3004	01.exe
Token: SeIncBasePriorityPrivilege	3004	01.exe
Token: SeCreatePagefilePrivilege	3004	01.exe
Token: SeBackupPrivilege	3004	01.exe
Token: SeRestorePrivilege	3004	01.exe
Token: SeShutdownPrivilege	3004	01.exe
Token: SeDebugPrivilege	3004	01.exe
Token: SeSystemEnvironmentPrivilege	3004	01.exe
Token: SeChangeNotifyPrivilege	3004	01.exe
Token: SeRemoteShutdownPrivilege	3004	01.exe
Token: SeUndockPrivilege	3004	01.exe
Token: SeManageVolumePrivilege	3004	01.exe
Token: SeImpersonatePrivilege	3004	01.exe
Token: SeCreateGlobalPrivilege	3004	01.exe
Token: 33	3004	01.exe
Token: 34	3004	01.exe
Token: 35	3004	01.exe
Token: 36	3004	01.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1080	2544	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe	85
PID 1080 wrote to memory of 4736	1080	ns8A0E.tmp	87
PID 2544 wrote to memory of 3004	2544	jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe	88
PID 3004 wrote to memory of 2428	3004	01.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.DNSChanger.ueb.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\nsx8A0D.tmp\ns8A0E.tmp
  "C:\Users\Admin\AppData\Local\Temp\nsx8A0D.tmp\ns8A0E.tmp" "C:\Users\Admin\AppData\Local\Temp\unrar.exe" e -o+ -unrar 00.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\unrar.exe
    "C:\Users\Admin\AppData\Local\Temp\unrar.exe" e -o+ -unrar 00.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4736
- C:\Users\Admin\AppData\Local\Temp\01.exe
  01.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    3⤵
    - Modifies registry class
    PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

00.exe

Path C:\Users\Admin\AppData\Local\Temp\00.exe
Size 32KB
SHA256 ea71575689ddc67b34c58b494efa11178dadf7285e6974b03c270e40b587758c
MD5 208f131098fe3119c94421960df742fd
SHA1 95e1dbb67640056652270d8a1240532e9bc3c129
SHA512 28e36b27396e2ae19b6976f829750643f319ad2732234802863727d72990fd066587398904afabc2535c9480dc38a5b2d96c8fab2297258db702ad63f1df39be
SSDEEP 768:RuRnF/ZdaRy9OfmYkQsBVXZV/HBtwxmJ8iV3P5ERp1Ajk:RuRFxdamimc+VXZRhtwIJ8i7EKk
TLSH
T11CE2E1A7E423B0116F16979B0587C0FEC255C128DF6B8DC5458767FE8A58E13045FEB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01.exe

Path C:\Users\Admin\AppData\Local\Temp\01.exe
Size 64KB
SHA256 1c0f271fdda1c1c548bed595414ac25d1153d63391ed8470a41c8befacd2e370
MD5 8908576d33b9df4414009550f2b5f8dc
SHA1 7b9173eada8fb71a642b5fc3cebb0063915a2dd1
SHA512 82fa8d692b474cf0ac66abe562e1990161e3823c059821583b58872bbc9ed16938e88dc2f47aee587b733f6ec49b62e31a6ef866b29dcd072f7d3f58ae88d0b1
SSDEEP 1536:WjIrMWnx+0M1TSzOCyk2GIyFcu8HTW+bPcqElBPCRqG:XrL+0M1TuOCykMyWt77cqElxC7
TLSH
T149535DB5C4C87C88E1E2C5F9EF38E6900E4397659658F443B5C8B96B07735FAA840CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartMenu.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx8A0D.tmp\StartMenu.dll
Size 6KB
SHA256 a5c5012191015659684fc19b5e8ec7d33837b25c607f0f9dbfd46c10b8baeb17
MD5 a6978ea99297c941d02d88fa873150d9
SHA1 4e1fd5c2f7291daef4d817b12bc7bfa432a90013
SHA512 8caf697317e6f9e83bbb0ee15a87ec56be3b08aaea9f7fb64fa65dd111bcfde5a8d25c7ef58fa1aa464ba5f9d4e365d9d8d3763cda17b4f3223418adf9a25000
SSDEEP 96:g1C0Qaep2wbE+WH1/FMXF6CGQhFzK1KQ5YnhElMmV4d:4ep2w5k/FyEt2gN
TLSH
T117D1E8B6F3C184F3CA47533079A7BF136B699A312325B253915766CAB5834E3EE20312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ns8A0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\nsx8A0D.tmp\ns8A0E.tmp
Size 6KB
SHA256 e2b3645086c5e0c75e3676db80fdb5d6a31e0f5bc7ee1689d077de1d02f46e7a
MD5 2b81b005983d2147fd587f6a54e2480e
SHA1 cb21d91fa43bec9b6948fdca4f312949e71beb9f
SHA512 b436f636824291301543a3ecae879139bce22b9246cd01da4f1da65aa51122ce18feb53886eba398f51e991677c694ed244b0521a32d27be40c98523c0a845fb
SSDEEP 96:GfX1XJXT0HmzbGVBHdMeLTOKcbI2NaeI0YqNnqN3rCUTEVX6pbc:Gfx1YHm3GVBHd3OKcbIs1zEZrCUTEVXu
TLSH
T166C1E8B7B6D22DF2C60E0A767C11206657B4D4281B680144EEB717C27A96DA3EC2528E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx8A0D.tmp\nsExec.dll
Size 6KB
SHA256 8a8bce943b78093ecd86a42c203931ee625f445acf5cb5b705e3b7eaf29c7110
MD5 03a1a9be1f1e72f926ec9161825eedd6
SHA1 d0574bafc615168c021788d413a3a73d275c492d
SHA512 8d82e15ee109d2236a995990fdd0c9fb39c9d3c4dea1c063f0806314e7a9d09a112f4f09091c265adba9f86ec7a0977294cce112e20ffb2f8b3ad62ab3dac396
SSDEEP 96:GCX1XJXT0HmzbGVBHdMeLTOKcbI2NaeI0YqNnqN3rCUTEVX6pbc:GQx1YHm3GVBHd3OKcbIs1zEZrCUTEVXu
TLSH
T1E3C1F9B7B6D23DF2C74E0A767C11206757B4D4241B680144EEB717C27A92EA3EC3528E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unrar.exe

Path C:\Users\Admin\AppData\Local\Temp\unrar.exe
Size 90KB
SHA256 264d49f5a489c51ba5f7b96e496120b5331625cbe67ea5b577acc63c12a21dac
MD5 d87ddf597baf91e7d32b20c0b4d855da
SHA1 4e855b5c03e0a52d8057bc86b83a07f10d00e455
SHA512 f6520aa83307eed340e214b4622f939a62dbbfdf9ce63e7c598250485615d617cb6eb503612e4440d55937e67d9bef270359c74a0efc4d082dc7e5d1355a3a26
SSDEEP 1536:SLNbEpkAr56pGQp79iBtHDAUrtSGk2/DpZw9NyotCMU6KeTI3l0yB6AbSt:SLNbpA96779iB5DAUrAt08yofKeMl5n
TLSH
T16793020AC654DDF7C95D82BC1ABE4C65035BC3A133968BC79402D99DFD543F06B9A908
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3004-27-0x000000006B800000-0x000000006B8F0000-memory.dmp

Download

memory/3004-42-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4736-18-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4736-23-0x0000000000400000-0x0000000000442000-memory.dmp

Download