ae42d1a182182b642651e656683366e42f2c490dc25af487ea95783572336486

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:04

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 264KB
Sample261009-vlcvrssv2n
SHA256 ae42d1a182182b642651e656683366e42f2c490dc25af487ea95783572336486
MD5 db595a43ae69764c70d026dd05b2141b
SHA1 fe33241acbcfa1bd623c99302ca27c3d49fba612
SHA512 be8b27b04f1255d1156d341b052b972b96934767bc84353cd5217fdfac86041c61d16371781d4def7694251a1e7209988194bc0f3623543419bed889f7eb24ee
SSDEEP 6144:wOxE4IsCa1FJ7SwOUfuWaFh89+Al+9X91hYNw4h7GIsro:wOBITiJ2wCWYieXewSGI
TLSH
T13A44122679791692F97B8734052BEF33C5A018249F34950917B8C7B8CEACBCD4D6E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Flilesoqaxalaz = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_HEUR.Trojan.Win32.Generic.dll\",Startup"	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	rundll32.exe
3328	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3328	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3328	4952	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3328