Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe
- Size 192KB
- Sample261009-xtargsea36
- SHA256 43fb8efbe5946313146d7aa151b8e30bf3ecb845499a29d95a4e75c51e5ff076
- MD5 2b759ea4e9b919bb31ec8e493d743020
- SHA1 1ac9466baa6542e7039cb2b642c4a5de224dede1
- SHA512 0516277507d8791dd840cc412017edd0511d4ccae56b3bf45961586bc19bcabe04c52750e244eb9e322a7a92694ff44ea598055cf4c238c79461ea9df9e5fc74
- SSDEEP 3072:FlMqIeQnzTkayfHQjYYpjcMo0xOMb70SKPP6fBUcZ+Sdj:D+tEaADYY0xOMb70SKPP6fBUcZ+Sdj
- TLSH T1DF140813B94C9413E1AB42B108E61BB5C923FC2448569D2BB340FE9E3D7B68065AD37F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AEB-13A2-11D3-846E-00A0C999732E}\VERSION jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF0-13A2-11D3-846E-00A0C999732E}\ProgID\ = "rvsIM.rvsIntegrationManager" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsDocument\Clsid jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE2-13A2-11D3-846E-00A0C999732E}\ProgID jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE2-13A2-11D3-846E-00A0C999732E}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE8-13A2-11D3-846E-00A0C999732E}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D1-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6CE-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D0-7D80-11D3-9CEB-0004AC13534F}\ = "_rvsDocuments" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF5-13A2-11D3-846E-00A0C999732E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsRegistrationManager\Clsid\ = "{1DDB7AEB-13A2-11D3-846E-00A0C999732E}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsIntegrationManager\ = "rvsIM.rvsIntegrationManager" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF5-13A2-11D3-846E-00A0C999732E}\Implemented Categories jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AEB-13A2-11D3-846E-00A0C999732E}\Programmable jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF0-13A2-11D3-846E-00A0C999732E}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE6-13A2-11D3-846E-00A0C999732E}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE2-13A2-11D3-846E-00A0C999732E} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE8-13A2-11D3-846E-00A0C999732E}\VERSION\ = "8.0" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D6-7D80-11D3-9CEB-0004AC13534F}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D2-7D80-11D3-9CEB-0004AC13534F}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF5-13A2-11D3-846E-00A0C999732E}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsDocuments jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D0-7D80-11D3-9CEB-0004AC13534F}\ = "_rvsDocuments" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D6-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D6-7D80-11D3-9CEB-0004AC13534F} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6CF-7D80-11D3-9CEB-0004AC13534F} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D8-7D80-11D3-9CEB-0004AC13534F} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsRegistrationManagerEvents\Clsid jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\TypeLib\Version = "8.0" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsApplication\ = "rvsIM.rvsApplication" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D5-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsApplication\Clsid\ = "{E84A347E-4B42-11D3-8476-00A0C999732E}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E84A347E-4B42-11D3-8476-00A0C999732E}\Programmable jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D2-7D80-11D3-9CEB-0004AC13534F}\TypeLib\Version = "8.0" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE8-13A2-11D3-846E-00A0C999732E}\Programmable jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB570F55-BD96-11D1-B9BC-006008BF3ACB} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB570F55-BD96-11D1-B9BC-006008BF3ACB}\8.0 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB570F55-BD96-11D1-B9BC-006008BF3ACB}\8.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D0-7D80-11D3-9CEB-0004AC13534F}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsApplication jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D0-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6CF-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\ = "__rvsRegistrationManagerEvents" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CB570F55-BD96-11D1-B9BC-006008BF3ACB}\8.0\FLAGS\ = "0" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D5-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D8-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AE8-13A2-11D3-846E-00A0C999732E}\ = "rvsIM.rvsDocuments" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6CD-7D80-11D3-9CEB-0004AC13534F}\TypeLib\Version = "8.0" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D1-7D80-11D3-9CEB-0004AC13534F} jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsRegistrationPool\Clsid jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6CF-7D80-11D3-9CEB-0004AC13534F}\ = "rvsDocument" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E84A347E-4B42-11D3-8476-00A0C999732E}\TypeLib jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D8-7D80-11D3-9CEB-0004AC13534F}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C064B6D5-7D80-11D3-9CEB-0004AC13534F}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D2-7D80-11D3-9CEB-0004AC13534F}\ = "__rvsRegistrationManager" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\rvsIM.rvsRegistrationManagerEvents\Clsid\ = "{1DDB7AF2-13A2-11D3-846E-00A0C999732E}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E84A347E-4B42-11D3-8476-00A0C999732E}\ProgID jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D6-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C064B6D7-7D80-11D3-9CEB-0004AC13534F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1DDB7AF5-13A2-11D3-846E-00A0C999732E}\TypeLib\ = "{CB570F55-BD96-11D1-B9BC-006008BF3ACB}" jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3344 jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.exe