1823a062b67843a75f225f932b40d64e2020f70089ac865da0463f17b1fefed0

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe
Size 82KB
Sample261006-talsvsav4y
SHA256 1823a062b67843a75f225f932b40d64e2020f70089ac865da0463f17b1fefed0
MD5 5f40f0167fde9fc07c00431b553b5b71
SHA1 37227630e1c4df49e17f30e28c772816cc79b825
SHA512 4ac53cc031e96e1badf1991b9ae4328388602d5ccaf8be9a78d9b8cb0fdbf0496374e41ffb0b347dedcc1e6e8e09e1e3c88d29413c325a32e504fbcdf5d8dd02
SSDEEP 1536:I3cpyORJLuB4P4AJJElFTKTk7U0PqjIOlbomnnh4lOgmtcQhjujkPX6:I3c1fP4AJJ0FT2cU0ulbomhNcQR446
TLSH
T1B383C05E76C25AABC232C1B31FBF8634BDBB435A1E9017073B245EA72B411877426287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3200	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	26533220999.exe

Loads dropped DLL 1 IoCs

pid	Process
4104	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 3200	4104	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe	91

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\%rCH3U5UF54DSxdE%\26533220999.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	4672	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26533220999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4672	4104	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe	89
PID 4104 wrote to memory of 3200	4104	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe	91
PID 4104 wrote to memory of 3200	4104	jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.exkk.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Program Files (x86)\%rCH3U5UF54DSxdE%\26533220999.exe
  "C:\Program Files (x86)\%rCH3U5UF54DSxdE%\26533220999.exe" /S
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 316
    3⤵
    - Program crash
    PID:2548
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4672 -ip 4672
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26533220999.exe

Path C:\Program Files (x86)\%rCH3U5UF54DSxdE%\26533220999.exe
Size 32.0MB
SHA256 99f60d08180c1f2d2d7c1e0cf2276de86aa21ca308d25695db755a7c940b1ede
MD5 25eaa6e6c6cbb8a9433e9530726e2955
SHA1 41841e5f7173d31941bdb2020f7df29e63c0171b
SHA512 a64a24db8de22800ab317f412855cf261314acf0bbe7c05fdecdbe2d71e9b9a193c5cce1e17470a7c3f7c13eb493a45b866bebd7bbf59a8e20fe537df643faf8
SSDEEP 768:f6BIL9jiueuek4wo/p5G4dFcUp1/ndXioHQAu+lxnLkjrGvgNmayibCQvIgt:fQIhjiuhXobdFcUp1/vQAuAnu4ywgt
TLSH
T1CF77F16727FC0742E870A1FB49FEE31E5A75A54D0CF7286E47E03BE05E59220CA609C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfDel.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu40DA.tmp\SelfDel.dll
Size 4KB
SHA256 7cb51ccf21655e9590a6c3232920b16a3dfef15ffe9df7b8e71f487ca8c24da9
MD5 5e14f6774c43bdff6ffe0afb0d51c47f
SHA1 fb1e7b6e63afa6db6aa2033b5e7e90f1f4ba5e27
SHA512 6ac533c0485156a68bd1460d8219acf7539b766590910cd646f4d7d4572c072f45369712d88d4e698f4e94aead8082abcbfacc3d6fe890046898f6c6d85274e3
TLSH
T11B8184B7F38524F3D5560673426B5AC399A1E4745B18442C88A3133A28E09E7F93D752
MD5 SHA1 SHA512 TLSH