Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 23:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037.dll
- Size 27KB
- Sample260925-3tkvcassbv
- SHA256 f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037
- MD5 2731301391e97757bcb44507ad412213
- SHA1 d1a3cf376b819601359e5a5d874547f9ebe1ee09
- SHA512 4bac183a961683713ee7ceb8f19aff8f42f3d988a8575094d684b3d6acfe19e4e387d73b939ca4978c329428358e5300c2dc5afa1958c0d809c4e527b18a8040
- SSDEEP 768:FKS0quAU0GQbSjYrG1rQrrf6pyLUCPIFP1:f0quAU0GQufrQr+l
- TLSH T18DC22B8BF6F1C932C014EDFCDD16C26ABB3E36283D2E19DA79981FCE9C99182450C546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HelpandWinDows.exe rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe 3808 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5856 wrote to memory of 3808 5856 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f3b57d7d5faf8c9b20d7dba6bfbcf0a0f91d5cc7fac716358e63329c6e8eb037.dll,#12⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3808
-