50b9b9f3bd9fb25579a9b70df05e80344884bb7fc5304cbbad88291657387ea6

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 31KB
Sample261009-t7dhraht8k
SHA256 50b9b9f3bd9fb25579a9b70df05e80344884bb7fc5304cbbad88291657387ea6
MD5 49439d7b5c5e59f7b84b1df03382a51c
SHA1 04638ed1d666e3a485eaa480ea492f9637b4b3c5
SHA512 69bb5fb6f57af6fa29f6ede2325870401877dacb379f9358d968b617c2cc1ec317feed0897c4adbc5dc4545b613b5ccecdb2a49cbef1170d91eaaea58465e43b
SSDEEP 768:U30eAUgDfCoHzMjzkbEr8Dhx07YLKMTwNjRfIwz:FeAUgDBmzuErg1X8ZlI
TLSH
T1A0E2F1C6A3DD9C5AE079B232571B8A3102EB7EB6D339B2852227075FDDC98395C11216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit

Malware Config

Signatures

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2676	takeown.exe
6016	icacls.exe
4084	takeown.exe
2236	icacls.exe
1084	takeown.exe
4716	icacls.exe
6116	takeown.exe
4576	icacls.exe

Loads dropped DLL 3 IoCs

pid	Process
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4084	takeown.exe
2236	icacls.exe
1084	takeown.exe
4716	icacls.exe
6116	takeown.exe
4576	icacls.exe
2676	takeown.exe
6016	icacls.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\iphlpapi.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\SysWOW64\hqvgof.fit	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\hqvgof.fit	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\rasapi32.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\mshtml.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\dsound.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2356	cmd.exe
5824	cmd.exe
940	cmd.exe
780	cmd.exe
4324	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1084	takeown.exe
Token: SeTakeOwnershipPrivilege	6116	takeown.exe
Token: SeTakeOwnershipPrivilege	2676	takeown.exe
Token: SeTakeOwnershipPrivilege	4084	takeown.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 5824	4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 5824 wrote to memory of 1084	5824	cmd.exe	91
PID 5824 wrote to memory of 4716	5824	cmd.exe	92
PID 4956 wrote to memory of 940	4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	93
PID 940 wrote to memory of 6116	940	cmd.exe	95
PID 940 wrote to memory of 4576	940	cmd.exe	96
PID 4956 wrote to memory of 780	4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	97
PID 780 wrote to memory of 2676	780	cmd.exe	99
PID 780 wrote to memory of 6016	780	cmd.exe	100
PID 4956 wrote to memory of 4324	4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	101
PID 4324 wrote to memory of 4084	4324	cmd.exe	103
PID 4324 wrote to memory of 2236	4324	cmd.exe	104
PID 4956 wrote to memory of 2356	4956	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	105

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\system32\iphlpapi.dll && icacls C:\Windows\system32\iphlpapi.dll /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\system32\iphlpapi.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\iphlpapi.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\system32\rasapi32.dll && icacls C:\Windows\system32\rasapi32.dll /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\system32\rasapi32.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\rasapi32.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\system32\mshtml.dll && icacls C:\Windows\system32\mshtml.dll /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\system32\mshtml.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\mshtml.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\system32\dsound.dll && icacls C:\Windows\system32\dsound.dll /grant administrators:F
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\system32\dsound.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\dsound.dll /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SetDelMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SetDelMe.bat

Path C:\Users\Admin\AppData\Local\Temp\SetDelMe.bat
Size 196B
SHA256 93c9e4ec21b88dca4e85f2dbb3c6f64857fee7e18f6c979a7d931665acdb19ee
MD5 c6804c1ef4f010f11db2e50ec067193a
SHA1 a02f3a6b4ca9c014328a4db3e01afe7e4888482f
SHA512 46c420dbc16b7e76ea9b5bdc7c3b86d4ea36690d0fe8194165b337263b2d1bff036a9643015cc7c7265c4f8b25b47ed86d9cae14f263f3383a839804916db573
TLSH
T1EBD0124181538B690850DC3F25389F8DD2558A9926C83F350732C3C4927341EB7D6B25
MD5 SHA1 SHA512 TLSH

Submit Download

hqvgof.fit

Path C:\Windows\SysWOW64\hqvgof.fit
Size 15KB
SHA256 2855f4f3417eaa6a7fc8ebc7f75f2c0c175a8756f886582e8a62659efa9c44cc
MD5 830266b1924fef4fa7cc9031d3134983
SHA1 59ae1f03e7131432125812cfdbc8c57ef2976c4c
SHA512 e77469e182764dc9cb36d8a4bb9fcc7a30889f5c259964c383d6f7fa1cabf63c999819930a14be4a02087ee84e62d5c0b0fee8c4297ba0ca6d8f57df023399a8
SSDEEP 384:shIjQKPdHl27G0lJ9god0KXMs1b7T9LciPxS1+y8nLor8hY8tAR4:syQKWPgouKXMI7JLcpcy8S81z
TLSH
T13162D0CE7B05B629C0AC5B74060B4C681D138D37D2D2B2395A2E7C8958CEEF34269B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iphlpapi.dll

Path C:\Windows\SysWOW64\iphlpapi.dll
Size 140KB
SHA256 67d73b945972ef7ec76162441cc83645a3d52b3ed71f08ee80a0dd54781b26ea
MD5 4fd1ad6d045fadb0115937ec73f9c6bc
SHA1 8ad57195ba615e025a5a8cd3dbfb6e6cafecd807
SHA512 b099e8739eb10536675fe3b96fdd0ec00c9e3604964df1443b591075f1097c7cee9c3e55bbe0d79d71b79d9f91ad8f70b586ae76d4d3a0a79cd60f75072c9b0c
SSDEEP 3072:92CE1Gtrx13xklII5E3/yIZnbR7vb0zE2Y:46FdklbEpZbJYz0
TLSH
T171E36B62FAC901B2CAEB31B4219F32764B7E82E457145AC343845FFBD855BD06E3429E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rasapi32.dll

Path C:\Windows\SysWOW64\rasapi32.dll
Size 959KB
SHA256 109c0444e29a12a5ca90ddf7043fe592938d00dd0dee2760b1e23e521a937d89
MD5 1cd9e82162d06e74cd4f58c6e9369cd6
SHA1 09dee824aa3cc9b5c703f5cb13618dac99f7414a
SHA512 01a16b7ca3dac87d948943b60f29522b860e8dbc4479a73f78d31c8c6b5865e6c647e398305d54fc4dcc0f07eeb36a72cbf1fcb8b67ce6951f90097f73faf138
SSDEEP 24576:FVEc8QyzXpTbuTzQC/Qo/SR7TfmBxK7uFbKqabVyzAfXmh:FyTNTCd6R/+3K7oTaBEAfXm
TLSH
T16A253B63C2DA80F2DAE22A74C10F572AA52B5D304F674CCB92D86E519834DD3A735B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4956-42-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4956-39-0x00000000035C0000-0x00000000035D9000-memory.dmp

Download

memory/4956-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4956-43-0x0000000074180000-0x00000000741CA000-memory.dmp

Download

memory/4956-44-0x00000000035C0000-0x00000000035D9000-memory.dmp

Download

memory/4956-49-0x0000000074180000-0x00000000741CA000-memory.dmp

Download

memory/4956-50-0x00000000035C0000-0x00000000035D9000-memory.dmp

Download

memory/4956-48-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4956-35-0x0000000074180000-0x00000000741CA000-memory.dmp

Download