b1fc9ee047bc7124c1096a6fe24ec206e3d901938629440546aa403fb3e55f09

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 140KB
Sample261009-txxtmscf22
SHA256 b1fc9ee047bc7124c1096a6fe24ec206e3d901938629440546aa403fb3e55f09
MD5 0d89683e529d1d2c29691a80cb9529d1
SHA1 0069d455fe4a26b77eb772e54576ae2af567d2b4
SHA512 5806ca7f6c116572aa7a3dd7f079815ab4e4f6bd3a98b4e15e6d67f581517a3f78a2c82e8322370b2ea3a23adff01c7069eb1014ed7ff257199d0d6872765237
SSDEEP 1536:uvyc89wtjdPn6tMJ+uDIc4Pb97JHEkp6CR/jl/t6Ip9AvzXfBknW8GLm:SyNwtjRn6luPWJkO6i/jlV4DfmW8sm
TLSH
T1CEE3CF1D58874513F4418C75CBE282C81FFE582333A736FFDB94196A16A06DD18BAAF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
788	Bwjijj.exe
1364	Bwjijj.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bwjijj = "C:\\Users\\Admin\\AppData\\Roaming\\Bwjijj.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 788 set thread context of 1364	788	Bwjijj.exe	92

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bwjijj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bwjijj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283211"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "645892626"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "650736171"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{51822EC0-C3FE-11F1-A0CA-7E1CC8EA832A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283211"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498328224"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4412	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4412	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	Bwjijj.exe
Token: SeDebugPrivilege	3348	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4664	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4664	IEXPLORE.EXE
4664	IEXPLORE.EXE
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE
3348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 1472 wrote to memory of 4412	1472	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87
PID 4412 wrote to memory of 788	4412	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	91
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 788 wrote to memory of 1364	788	Bwjijj.exe	92
PID 1364 wrote to memory of 3460	1364	Bwjijj.exe	97
PID 3460 wrote to memory of 4664	3460	iexplore.exe	98
PID 4664 wrote to memory of 3348	4664	IEXPLORE.EXE	99
PID 1364 wrote to memory of 3348	1364	Bwjijj.exe	99
PID 1364 wrote to memory of 3348	1364	Bwjijj.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Admin\AppData\Roaming\Bwjijj.exe
    "C:\Users\Admin\AppData\Roaming\Bwjijj.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Users\Admin\AppData\Roaming\Bwjijj.exe
      C:\Users\Admin\AppData\Roaming\Bwjijj.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1364
    - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
        
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3460
      - C:\Program Files\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4664 CREDAT:17410 /prefetch:2
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 0358c3bf535535f06d1fab34399bcba2f546d271fc13634c3ec363a27e6b56af
MD5 dacc3f844934847c327440efed9d15a6
SHA1 4f8bde193fd979bc59c666767d56480fec2106d3
SHA512 9f691e32b7f9219f1c9410cecbce993d60c351bd1b23528145a28119f98e84d5e615bff2adc21c24945ef105fb504046725159212c02cb5679d0c34681137643
TLSH
T1C8F0548994E6F7E1DF81C8EC03B4459F342090A646555285317C45F1404535FFE1F0B5
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 3654a98d561cf5e19f8588d51b34c131a7910251bf8a36b3695b1300bdd27f14
MD5 a10cbfc75e6cbe02ee031bcc0340c397
SHA1 2c504bdcae40ae3c9bcefdc986b1f7aff21535b6
SHA512 74f11ab1ffcde93809ce79603fabe910970a3362704b5accc62bf7fae00305fded40c636fe2f95566dfb9d5b1fe1e1ad05b417d0af7b3a8438fea6d0619e1172
TLSH
T102E07D2411FA411FE5F4E4398BD9753594AEF122152DF2B425D49B04F703A40ED03A39
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ITXMUND\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bwjijj.exe

Path C:\Users\Admin\AppData\Roaming\Bwjijj.exe
Size 140KB
SHA256 b1fc9ee047bc7124c1096a6fe24ec206e3d901938629440546aa403fb3e55f09
MD5 0d89683e529d1d2c29691a80cb9529d1
SHA1 0069d455fe4a26b77eb772e54576ae2af567d2b4
SHA512 5806ca7f6c116572aa7a3dd7f079815ab4e4f6bd3a98b4e15e6d67f581517a3f78a2c82e8322370b2ea3a23adff01c7069eb1014ed7ff257199d0d6872765237
SSDEEP 1536:uvyc89wtjdPn6tMJ+uDIc4Pb97JHEkp6CR/jl/t6Ip9AvzXfBknW8GLm:SyNwtjRn6luPWJkO6i/jlV4DfmW8sm
TLSH
T1CEE3CF1D58874513F4418C75CBE282C81FFE582333A736FFDB94196A16A06DD18BAAF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-16-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1364-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1364-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1364-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1472-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1472-3-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4412-5-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4412-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4412-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4412-1-0x0000000000400000-0x0000000000429000-memory.dmp

Download