Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 263KB
- Sample261009-vfjfcscg66
- SHA256 21e3c160be6448e02f19df4034b1b0b1a035cd952a59c6c694a2acfeab1c0105
- MD5 a4c014bf31f73257f60652143d35bef9
- SHA1 155a053e7c7de51a53685a51d106a5c1eb9a0317
- SHA512 273a994ec0c4fac73aa819c543cb29f415ae706dd7da7211ddd1b9f4416ad0decaea255dea9fdb37f716ad75d624a99134c9043398f08c6b87acedd926224e68
- SSDEEP 6144:Kd16R9dkSnt/iRCw8C5AUlwkpf/DZLH6Mzfr3Bi1LeS5i:Q25t0GsB6Mf01
- TLSH T129448D2973A2C032E6A36035594AD3B295AD76305CA5928BB7D04F3E9F343E1D72770B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- A potential corporate email address has been identified in the URL 10 IoCs
description flow ioc pid Process Email address 2 [email protected] 3416 lhidukpripzq.exe Email address 3 [email protected] 2948 lhidukpripzq.exe Email address 4 [email protected] 3416 lhidukpripzq.exe Email address 5 [email protected] 3416 lhidukpripzq.exe Email address 6 [email protected] 3416 lhidukpripzq.exe Email address 7 [email protected] 2948 lhidukpripzq.exe Email address 11 [email protected] 2948 lhidukpripzq.exe Email address 8 [email protected] 2948 lhidukpripzq.exe Email address 9 [email protected] 2948 lhidukpripzq.exe Email address 10 [email protected] 3416 lhidukpripzq.exe - Executes dropped EXE 4 IoCs
pid Process 3416 lhidukpripzq.exe 3700 snnftrrbwfa.exe 2948 lhidukpripzq.exe 1164 snnftrrbwfa.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserMode Peer Support Services Interface Tablet = "C:\\Users\\Admin\\Local Settings\\Application Data\\vjzwwwidfmypcp\\lhidukpripzq.exe" jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lhidukpripzq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lhidukpripzq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname lhidukpripzq.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain lhidukpripzq.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhidukpripzq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language snnftrrbwfa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhidukpripzq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3416 lhidukpripzq.exe 3416 lhidukpripzq.exe 3700 snnftrrbwfa.exe 3700 snnftrrbwfa.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 1164 snnftrrbwfa.exe 1164 snnftrrbwfa.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe 3416 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 2948 lhidukpripzq.exe 3416 lhidukpripzq.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3416 wrote to memory of 3700 3416 lhidukpripzq.exe 93 PID 1352 wrote to memory of 2948 1352 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 94 PID 2948 wrote to memory of 1164 2948 lhidukpripzq.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"2⤵
- A potential corporate email address has been identified in the URL
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\snnftrrbwfa.exeWATCHDOGPROC "C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1164
-
-
-
C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"1⤵
- A potential corporate email address has been identified in the URL
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\snnftrrbwfa.exeWATCHDOGPROC "C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\vjzwwwidfmypcp\lhidukpripzq.exe
- Size 263KB
- SHA256 21e3c160be6448e02f19df4034b1b0b1a035cd952a59c6c694a2acfeab1c0105
- MD5 a4c014bf31f73257f60652143d35bef9
- SHA1 155a053e7c7de51a53685a51d106a5c1eb9a0317
- SHA512 273a994ec0c4fac73aa819c543cb29f415ae706dd7da7211ddd1b9f4416ad0decaea255dea9fdb37f716ad75d624a99134c9043398f08c6b87acedd926224e68
- SSDEEP 6144:Kd16R9dkSnt/iRCw8C5AUlwkpf/DZLH6Mzfr3Bi1LeS5i:Q25t0GsB6Mf01
- TLSH T129448D2973A2C032E6A36035594AD3B295AD76305CA5928BB7D04F3E9F343E1D72770B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Local Settings\Application Data\vjzwwwidfmypcp\lhidukpripzq.akv
- Size 4B
- SHA256 fbf69fb49bfaa8e00f0fd48ce391163da23ddeca1f76f51f07cd4b4e5bf4c4ae
- MD5 25ed8448f5055c4584a25a04c9851ac4
- SHA1 9181d83aa0db1838b0953c2501211f3dda1f6ad5
- SHA512 461870b126c582ca65b86b585b403ff57582ba48bb32568e60705606b3dd83d08321d75e31ac2adff5b1c62e6ecb70017038c59e49fa87b8c5ebdc9fd3a4d251
- MD5 SHA1 SHA512