Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 23:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2.dll
- Size 27KB
- Sample260925-3xpbyazbnd
- SHA256 9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2
- MD5 3eb3a1da78c9e6d3544a4afdd55028dd
- SHA1 c1d32966572d4a46a845b2491081db6bdd95ab15
- SHA512 e64fb9811b97fe14b170fe664d9aa46dc4c9af68283ad68e42a990d18741253fda8e2ac55f59fd23df5f4bbf140459422b55e3de85f16bf3da26b28e4dc358b7
- SSDEEP 768:FKS0quAU0GQbSjYrG1rQrrf6pyLUCPIFPH:f0quAU0GQufrQr+X
- TLSH T11DC22B8BF6F1C932C014EDFCDD16C26ABB3E36283D2E19DA79981FCE9C99182451C546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HelpandWinDows.exe rundll32.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe 2952 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1472 wrote to memory of 2952 1472 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9c5ef9d71d7271f73cd631eafd4f9e5e835ab84c24d0ab3d9c68b5d64f275ee2.dll,#12⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2952
-