Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe
- Size 124KB
- Sample261009-w2ly2sdd73
- SHA256 f0e25325461cbfa62443f057a97ad42c6a36d991fe87a7737cd41e1d3226e06b
- MD5 9d119cb5ee55478e0a979b9c40698dc8
- SHA1 60f2597b06b5de90917acffce9e03eb418211344
- SHA512 5adbc38f57ceac65591a79a27c6d4af451e17b1e5ddb8f42552cfed0b8bf7a5c084c0a26c26df5cb8282a8f8fb8f28e27a38b4bc8a0d9a9bf86eab0e7680b314
- SSDEEP 3072:u5v6s3BAP/bEBHIdhwlJJxZC4cEkqG6bbMkIT3EzxbrYfGXsout:26Ii/IBHIdOlJHIEjbbMNTmfYuXsoS
- TLSH T1DEC3121E5131E2E4C8DD5E394DD2695401CAB20D88F3EBA569EC8427DC83FF53969C2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe - Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 1 IoCs
pid Process 248 heshang.exe - Loads dropped DLL 1 IoCs
pid Process 4032 rundll32.exe -
resource yara_rule behavioral2/files/0x0003000000000434-9.dat vmprotect - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\Disker = "rundll32.exe C:\\Windows\\system32\\HIMYM.DLL,DW" rundll32.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\HIMYM.DLL heshang.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language heshang.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe 248 heshang.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe Token: SeDebugPrivilege 248 heshang.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5532 wrote to memory of 248 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 89 PID 248 wrote to memory of 4032 248 heshang.exe 90 PID 248 wrote to memory of 5464 248 heshang.exe 92 PID 5532 wrote to memory of 3164 5532 jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe"1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\heshang.exeC:\Users\Admin\AppData\Local\Temp\heshang.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\HIMYM.DLL,DW3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4032
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\heshang.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5464
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Demp.ggo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3164
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1AppInit DLLs
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\HIMYM.DLL
- Size 92KB
- SHA256 a92e4cd845047900abba947ad4ff42d817ce977d2bea1322741fa9c32c93eabc
- MD5 39177689723fa049b08e88480a07d82d
- SHA1 7619a1a861302f62de0e356be7930ee02d2b510e
- SHA512 0d5f6cc9bb7e95b0acf945d5d59f5b9418919ac0cec76534ce8f1a8612c6af5d18d25d10a1c13da3284afc667b1b65e0b7f3d685086fd70ac3d15f7106b76877
- SSDEEP 1536:MHjxDw7trJMCAQJjuqHCu/YWsBOvr+wEzinR:MHuhr+ZBmrTEOnR
- TLSH T1BA936D53AADC41F0E6A41B34308B1BB6D27F02702A1795D76F47F84188B79B1AA7C783
- MD5 SHA1 SHA512 SSDEEP TLSH