Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 14:35
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe
- Size 23KB
- Sample261006-rx5hdact9l
- SHA256 b603eb14c0e4aa84e7cc695ee9ff4f53f0f44ad23f5e74c4dab969187d8d681a
- MD5 6399de5b3f0aead72b00e7803a5a3da4
- SHA1 cd7978d5fe11dbfb92fe42b042854ed4bd3aebd9
- SHA512 a80721df134e54dc7b2cb50283610403960622847de6bee2f6bc05835f7a15ccccbf779e20a1d9dbac5eefc4d7f554c6f6f9968272521ff4c87481c8e60caf77
- SSDEEP 384:5YOg+I4KVSZWr49zmaXGsDbHNA/v0jPiE8nb/mFeklzp+QWXWIa:C7fVSi4R/bHNAdE8nb4lzc1
- TLSH T133B28D167EE4D818D34E723285AB6EDDC010AFB1535A1AD775B1BA4FFA622C04B71330
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3328-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3328-4-0x0000000000400000-0x0000000000410000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3328 jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe 3328 jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe 3328 jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe 3328 jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3328 jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.VB.zu.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3328