Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe
- Size 140KB
- Sample261006-rt2bjs1sds
- SHA256 de46e07319b881b4fde969652c22b4444157b3142f8e291cb28929508506e2ec
- MD5 8cca59953ab3cabd6942b046c3eedf7f
- SHA1 7d8e2e1f0eaba9ee677922221d6cd30bd6c4420e
- SHA512 a058c1787b46305e6d537392b7added09b365d8472e0bd597a05089abd42316c3657140bc001575bf3b98312029f15f37ccd6f103b17adff3ae67f8c7d00d27d
- SSDEEP 1536:U2rCvVIZakUJEPW8mhIiNjNpxupo7WdW7EIpEmbQ62aRsi3tU1EJWd:jeyZ3jzeI2W07l2v6jRsidUGU
- TLSH T1BFE30913BB55A01AF567C9B01C35A494792B7C671EA0DD0B3281BB0E9AB1683BDF071F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\HELPDIR jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\LocalServer32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\VERSION jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\LocalServer32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\TypeLib\Version = "4.0" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ProxyStubClsid32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\ProgID\ = "prjSecRec708.CVSVirus" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\VERSION\ = "4.0" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\ = "prjSecRec708" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\FLAGS jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\TypeLib\Version = "4.0" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CVSVirus\Clsid jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\VERSION jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\Implemented Categories jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ = "_CHXSoft" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ = "_CVSVirus" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CHXSoft\ = "prjSecRec708.CHXSoft" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\FLAGS\ = "0" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60725B19-13ED-426F-AC07-837D33868638}\TypeLib jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\VERSION\ = "4.0" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ProxyStubClsid jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CHXSoft jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\0\win32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\TypeLib jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\ProgID\ = "prjSecRec708.CHXSoft" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ProxyStubClsid32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\ = "prjSecRec708.CHXSoft" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60725B19-13ED-426F-AC07-837D33868638}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CVSVirus jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\Implemented Categories jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195}\Programmable jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\0 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B34EEBF8-EC91-4020-8562-ACE3C81943FA}\4.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ = "_CHXSoft" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7F2D24C6-6703-4902-9470-72D48E81B195} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ = "CVSVirus" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\ProgID jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CHXSoft\Clsid\ = "{B26511DB-0A94-418C-BDCE-C410505C5275}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638} jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60725B19-13ED-426F-AC07-837D33868638}\ = "_CVSVirus" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CVSVirus\ = "prjSecRec708.CVSVirus" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\prjSecRec708.CVSVirus\Clsid\ = "{7F2D24C6-6703-4902-9470-72D48E81B195}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\ProxyStubClsid32 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\TypeLib jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\TypeLib\ = "{B34EEBF8-EC91-4020-8562-ACE3C81943FA}" jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B26511DB-0A94-418C-BDCE-C410505C5275}\Programmable jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A680A1C-4E6D-4D71-A392-B2B5FCA4C8C0}\TypeLib jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4108 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe 4108 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe 4108 jaffacakes118_Trojan-Downloader.Win32.VB.mh.exe