9f15d3382f183f6564dd2d2f0d6a850f02c803eaf208df08d1c3240961fd1ad9

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe
Size 28KB
Sample261006-rlq6lsfc25
SHA256 9f15d3382f183f6564dd2d2f0d6a850f02c803eaf208df08d1c3240961fd1ad9
MD5 58afa6661cd3e8f05de6f3eb24c45e54
SHA1 a9e8c5497f16fd364d5593fb33bb683ee27b43ad
SHA512 b348fc5255eb701c32c7ff27de520a042d393cc1488b33fc20f789fff17ec0f4587ec115abc1c40cc0a234693e2a4a4a54068ff7a0d475ec90533546bb828a1a
SSDEEP 384:T607iRmC8WUaRQy4xIh3ITA3sR1+z0j9t0pP0E8nl/mFeklzp+2W8NWTT:m0daBBnik3sOyZE8nl4lzcb
TLSH
T1C9D2AE503FF9D824E72E793650AB6EDCC012B7B29B4A4BDB2571764EE9210D04BB1331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4916-0-0x0000000000400000-0x0000000000415000-memory.dmp	upx
behavioral1/memory/4916-6-0x0000000000400000-0x0000000000415000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4916	jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 724	4916	jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe	85

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.bat C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_Trojan-Downloader.Win32.VB.avz.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.avz.bat
Size 69B
SHA256 90423a49e145f44c6cefc80ba4351d04a4eaaee2b86e38aad1d9927fbad3d7bf
MD5 e3b0a4ae48f7cfe95b51f8d3cfd329d0
SHA1 16d9435d895dcf1680baf5b8ebc6342f561af049
SHA512 5abd674b6e8896bedacd7e0ae593d49771f5c5a036adab1963a37e38f5f2cf185b157d101e97c6e1572b5ae4dfcbfa0470871b2faa0a8d96c6dae19b1329b9f3
TLSH
T138A022C000000C8B2CC088BC828FB08EF20C83E3030800023C33ACC0C2BC320C0E0E02
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4916-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4916-6-0x0000000000400000-0x0000000000415000-memory.dmp