340a5ec696a14017ff01733eb4a53e939faffc6164dbb91768a9660bc12507e5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe
Size 9KB
Sample261006-tha2bsfe38
SHA256 340a5ec696a14017ff01733eb4a53e939faffc6164dbb91768a9660bc12507e5
MD5 804d2d1ec74daf69e428cfb428413ba4
SHA1 86834f4a36136c3d1615ffe58103cbb79a0273e3
SHA512 061cc7aca9534d35dccba60ebaa88e47e6fce8436853ad1ec2389f19efac0aea8d33782be2b1943faf69ceb53aefcdb72007213ba0eb99eb7dbb0276bdf49308
SSDEEP 192:JdolXLvt3my4w3WIjwt2j605XgNaQUnT:JduxFL3WxUFAenT
TLSH
T1D1127F8B7069DFB3C55E227203E396365A1B7C10472697497EE9741B75F71BA0C8F100
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5648	msmsgs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN Messenger = "C:\\Windows\\system32\\msmsgs.exe"	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msmsgs.exe	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4640-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4640-11-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msmsgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5648	msmsgs.exe
5648	msmsgs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	msmsgs.exe
Token: SeIncBasePriorityPrivilege	4640	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 5648	4640	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe	89
PID 4640 wrote to memory of 4368	4640	jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.lb.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\msmsgs.exe
  "C:\Windows\system32\msmsgs.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msmsgs.exe

Path C:\Windows\SysWOW64\msmsgs.exe
Size 10KB
SHA256 07bfd7c10768c06e4168862e41d46c1f17ae0026074f24c2031f78a8b20479fe
MD5 ee0bf6451c8d9a169cb1e3db6cb75f33
SHA1 e80e7aabcc017a970212908ad3740354e096a971
SHA512 e89d16164985674ed9241f2021684ecd73bbc8f5bc6e2e3d09e5367bdf09d2529dd731d491a5341cc9621a3ed019c37a72a580dfa156077e20fbcfe0c6309859
SSDEEP 192:PjwxYvlavAYbuTgl2AHxheLm2E+lLPV0UMGqmhjLcytXZSm:rwxY9wDbVxRILmUV5Mm4ytpSm
TLSH
T1102208A6C17C4833E007117219E92B075BAAED24B677ECE3CB805B4665733E1972D20F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4640-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4640-11-0x0000000000400000-0x000000000040A000-memory.dmp

Download