e761b73cb84a73436bf35b2836bd71a8d18ea2e9c837bbe087e75f1959a72a1d

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:30

Target
jaffacakes118_Trojan-Downloader.Win32.Small.aih.dll
Size 9KB
Sample261006-pphyasy1cs
SHA256 e761b73cb84a73436bf35b2836bd71a8d18ea2e9c837bbe087e75f1959a72a1d
MD5 7f0fb4827516772592988f74c716e721
SHA1 ff854b15e182c32c425aa436feb891791d0f36e8
SHA512 e38c243d95c36be0cfe58233e53b9ddf9e63f6fb30dd27394b0847a0a04c706205b97b207ed156ef69409d5609042407c828ecaa1ff50dce3c4f3d70428624f4
SSDEEP 192:PR5BsN6E7MCscSl9gliznLs+tpUWU8rOyXqX2phcTj1:PPBsN6TCPS2iDLeWU8rOyE2jcP1
TLSH
T10D12E8933A906CF3C0406F3413DEEB17F6A2A0B123246C15D7D52D862E7A196571BF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaffacak = "\"C:\\Windows\\system32\\jaffacakes118_Trojan-Downloader.Win32.Small.aih.exe\""	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jaffacakes118_Trojan-Downloader.Win32.Small.aih.dll	rundll32.exe
File created	C:\Windows\SysWOW64\jaffacakes118_Trojan-Downloader.Win32.Small.aih.exe	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
568	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 568	3652	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.aih.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.aih.dll,#1
  2⤵
  - Badlisted process makes network request
  - Adds Run key to start application
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:568