Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 17:22
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Agent.zvsp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Agent.zvsp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Agent.zvsp.dll
- Size 21KB
- Sample261006-vxsqcssvhy
- SHA256 a73ace0087ae339c4fcb98809fdb32dca13f77430c272792991e50e9f7eb859f
- MD5 a66c5d9b7456da67130742d75c52647c
- SHA1 ad85bbaca9678e8ae5d642406cf90da0b6e88a2b
- SHA512 5c3bb32de8398e08602ec2cb7bbc8d88167c88c60ec579686f0b545ba17fcd6ba3749f01b783d2dc788e642931729905ab84207ebe38f86cbd4f8bef08d8bb8f
- SSDEEP 384:TMLWCpCJ6xhD8+kg7QpFls56uDo4WEpF5Z1BRIqd8jXU3bj2OTo:uzZj8+d7QpFHuDoTOFPfL3bj7
- TLSH T160A2D04AB3ABCCFBEB560A36728E152D130571F003C79A04BF48548BAC4EAD09C95F6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Stops running service(s) 4 TTPs
-
resource yara_rule behavioral2/memory/5136-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5136-11-0x0000000000400000-0x000000000041F000-memory.dmp upx - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3024 sc.exe 2820 sc.exe 3824 sc.exe 6080 sc.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID rundll32.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe 5136 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5136 rundll32.exe Token: SeAuditPrivilege 3688 svchost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3200 wrote to memory of 5136 3200 rundll32.exe 88 PID 5136 wrote to memory of 2300 5136 rundll32.exe 90 PID 5136 wrote to memory of 6080 5136 rundll32.exe 92 PID 5136 wrote to memory of 3024 5136 rundll32.exe 94 PID 5136 wrote to memory of 2820 5136 rundll32.exe 96 PID 5136 wrote to memory of 3824 5136 rundll32.exe 99
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.zvsp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.zvsp.dll,#12⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe import "C:\Users\Admin\gaur.avi"3⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe config PolicyAgent start=auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6080
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3024
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe start PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2820
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3824
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Drv.sys
- Size 3KB
- SHA256 2e31fa2f81f0e4063c32de47bb2ff5efa26be1433fa2ce1428704840ef4b9844
- MD5 c85a8f021cb397d89befd8c3155c3c1c
- SHA1 537a87726faa748292f75fa330dd200465b0f29a
- SHA512 bc4f9eede4d12dbd4988d88cff0ae379aa82dad569c7ffb4400760c428166371bb86314fa0edae9b6eab0c3cdc57d61d84704de7aeb1b3a37daa7bb63b2af395
- TLSH T18E81A3401205A7F0CDEC1870BDA399D7E6F328A2859BDB0A265060CE7E3C7416026E1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\gaur.avi
- Size 56KB
- SHA256 59b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f
- MD5 bc8025bc98da7f4ed891c9f9991d3ff1
- SHA1 70a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d
- SHA512 7f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5
- SSDEEP 384:TYC0Yj2XvJtOMJkjT0VAC9w5SSIf5GpbKV0VAC9w5SSIf5GpGp0VAC9w5SSIf5GN:TYCXgtzUK82UWnpUnmV9E8U5
- TLSH T17E433236DBA5205682F78D78CEF24067EE6A3907363CDC4E54C22F4A0A93E4D686175F
- MD5 SHA1 SHA512 SSDEEP TLSH