Analysis
- max time kernel
148s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/10/2026, 20:17
General
- Target jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
- Size 7.4MB
- Sample261009-y239faes2w
- SHA256 27fa51ad4a0e4399f0709745d91a82690c75f55ebe5b77d9d3e925d1f17910d8
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 22 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\resgfvr.exe"C:\Users\Admin\AppData\Local\Temp\resgfvr.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxokta.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxoktb.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxoktc.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\pag5.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\pag4.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wd.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG Delete HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace /f4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exeREG Delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exeREG Add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ /ve /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exeREG Add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{C42EB5A1-0EED-E549-91B0-153485860982}\ /ve /f4⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
C:\Windows\SysWOW64\regini.exeregini.exe tmp.ini4⤵
-
-
C:\Windows\SysWOW64\reg.exereg.exe query "HKEY_CURRENT_USER\Software\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-153485753982}\Shell\Z\Command"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regini.exeregini.exe tmp.ini4⤵
-
-
C:\Windows\SysWOW64\regini.exeregini.exe tmp.ini4⤵
-
-
C:\Windows\SysWOW64\regini.exeregini.exe tmp.ini4⤵
- Modifies registry class
-
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\shipin.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
resgfvr.exe
shipin.mp4
tmp.ini
tmp.ini
tmp.ini
wd.bat
vlc-qt-interface.ini
ialxokta.vbs
ialxoktb.vbs
ialxoktc.vbs
pag4.vbs
pag5.vbs
memory/704-78-0x00007FFCFE610000-0x00007FFCFE635000-memory.dmp
memory/704-77-0x00007FFCFD1D0000-0x00007FFCFD21F000-memory.dmp
memory/704-54-0x00007FFD0BEC0000-0x00007FFD0BEF4000-memory.dmp
memory/704-53-0x00007FF7DD4B0000-0x00007FF7DD5A8000-memory.dmp
memory/704-56-0x00007FFD0BAD0000-0x00007FFD0BAE1000-memory.dmp
memory/704-59-0x00007FFD0B8A0000-0x00007FFD0B8CB000-memory.dmp
memory/704-58-0x00007FFD0BA80000-0x00007FFD0BAA2000-memory.dmp
memory/704-61-0x00007FFD0B790000-0x00007FFD0B7A4000-memory.dmp
memory/704-62-0x00007FFD0B770000-0x00007FFD0B781000-memory.dmp
memory/704-60-0x00007FFCFD950000-0x00007FFCFDCE0000-memory.dmp
memory/704-63-0x00007FFD0B0C0000-0x00007FFD0B192000-memory.dmp
memory/704-74-0x00007FFD03C00000-0x00007FFD03C11000-memory.dmp
memory/704-343-0x00007FFCFE0C0000-0x00007FFCFE376000-memory.dmp
memory/704-81-0x00007FFCFD0E0000-0x00007FFCFD0F2000-memory.dmp
memory/704-84-0x00007FFCF25C0000-0x00007FFCF2805000-memory.dmp
memory/704-83-0x0000022878130000-0x00000228782EA000-memory.dmp
memory/704-82-0x0000022877E60000-0x0000022878129000-memory.dmp
memory/704-80-0x00007FFCFD100000-0x00007FFCFD11B000-memory.dmp
memory/704-79-0x00007FFCFD120000-0x00007FFCFD1CB000-memory.dmp
memory/704-247-0x00007FFCFE0C0000-0x00007FFCFE376000-memory.dmp
memory/704-76-0x00007FFCFD220000-0x00007FFCFD2B8000-memory.dmp
memory/704-75-0x00007FFCFD2C0000-0x00007FFCFD4CB000-memory.dmp
memory/704-73-0x00007FFD0AD30000-0x00007FFD0AD41000-memory.dmp
memory/704-72-0x00007FFD0B050000-0x00007FFD0B06A000-memory.dmp
memory/704-71-0x00007FFD076B0000-0x00007FFD076DD000-memory.dmp
memory/704-69-0x00007FFD0B260000-0x00007FFD0B278000-memory.dmp
memory/704-68-0x00007FFD0B740000-0x00007FFD0B76F000-memory.dmp
memory/704-67-0x00007FFD03C20000-0x00007FFD03C61000-memory.dmp
memory/704-66-0x00007FFCFD4D0000-0x00007FFCFD5B3000-memory.dmp
memory/704-65-0x00007FFCFD5C0000-0x00007FFCFD6A8000-memory.dmp
memory/704-64-0x00007FFCFD6B0000-0x00007FFCFD946000-memory.dmp
memory/704-70-0x00007FFD0AFE0000-0x00007FFD0B006000-memory.dmp
memory/704-57-0x00007FFD0BAB0000-0x00007FFD0BAC9000-memory.dmp
memory/704-55-0x00007FFCFE0C0000-0x00007FFCFE376000-memory.dmp
memory/704-151-0x00007FFCFE0C0000-0x00007FFCFE376000-memory.dmp
memory/736-37-0x0000000000400000-0x000000000040C380-memory.dmp
memory/4396-19-0x0000000000400000-0x0000000000B630D0-memory.dmp