Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 19:53
General
- Target jaffacakes118_Trojan-Dropper.Win32.Small.dkt.exe
- Size 19KB
- Sample261009-ymfjtsvs8n
- SHA256 315d5c481fde8f0c0886f90f42443268f69ba18831fca26bf0cd3a4df35bdc20
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Deletes itself 1 TTPs 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 26 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.dkt.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Small.dkt.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe rundll32.exe calc.ifo beforemain1⤵
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Process Injection
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Process Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
B51.tmp
memory/4108-45-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4284-51-0x000000000D110000-0x000000000D278000-memory.dmp
memory/4284-50-0x000000000CE20000-0x000000000D103000-memory.dmp
memory/4320-16-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-18-0x00007FF950370000-0x00007FF950380000-memory.dmp
memory/4320-9-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-7-0x00007FF99267F000-0x00007FF992680000-memory.dmp
memory/4320-12-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-11-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-14-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-13-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-8-0x00007FF952660000-0x00007FF952670000-memory.dmp
memory/4320-15-0x00007FF950370000-0x00007FF950380000-memory.dmp
memory/4320-19-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-10-0x00007FF952660000-0x00007FF952670000-memory.dmp
memory/4320-17-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-20-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-21-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-41-0x000002455D680000-0x000002455D84A000-memory.dmp
memory/4320-42-0x00007FF992520000-0x00007FF992783000-memory.dmp
memory/4320-5-0x00007FF952660000-0x00007FF952670000-memory.dmp
memory/4320-4-0x00007FF952660000-0x00007FF952670000-memory.dmp
memory/4320-6-0x00007FF952660000-0x00007FF952670000-memory.dmp
memory/6120-49-0x0000000060380000-0x000000006038D000-memory.dmp
memory/6120-48-0x00007FF992520000-0x00007FF992783000-memory.dmp