Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
09/10/2026, 20:38
General
- Target jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe
- Size 205KB
- Sample261009-zer4bsvx6l
- SHA256 5eba5a8720435dc984ac230f705633deac8052567573ca0ea675382d17be9d26
Malware Config
Signatures
- Family: PoisonIvy
PoisonIvy is a remote access trojan used by many threat actor groups, first seen in 2005.
- Detects PoisonIvy RAT 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.ahht.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/792-0-0x0000000000400000-0x000000000043A000-memory.dmp
memory/792-1-0x0000000002110000-0x0000000002153000-memory.dmp
memory/792-7-0x00000000021B0000-0x00000000021B1000-memory.dmp
memory/792-6-0x00000000021C0000-0x00000000021C2000-memory.dmp
memory/792-5-0x0000000002170000-0x0000000002171000-memory.dmp
memory/792-4-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/792-3-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/792-2-0x0000000002100000-0x0000000002101000-memory.dmp
memory/792-20-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/792-19-0x0000000002B00000-0x0000000002B01000-memory.dmp
memory/792-18-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/792-17-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/792-16-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/792-15-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/792-44-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/792-43-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/792-90-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/792-89-0x0000000003070000-0x0000000003071000-memory.dmp
memory/792-88-0x0000000003080000-0x0000000003081000-memory.dmp
memory/792-87-0x0000000003050000-0x0000000003051000-memory.dmp
memory/792-86-0x0000000003060000-0x0000000003061000-memory.dmp
memory/792-85-0x0000000003030000-0x0000000003031000-memory.dmp
memory/792-84-0x0000000003040000-0x0000000003041000-memory.dmp
memory/792-83-0x0000000003010000-0x0000000003011000-memory.dmp
memory/792-82-0x0000000003020000-0x0000000003021000-memory.dmp
memory/792-81-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/792-80-0x0000000003000000-0x0000000003001000-memory.dmp
memory/792-79-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/792-78-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/792-77-0x0000000002FB0000-0x0000000002FB1000-memory.dmp
memory/792-76-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
memory/792-75-0x0000000002F90000-0x0000000002F91000-memory.dmp
memory/792-74-0x0000000002FA0000-0x0000000002FA1000-memory.dmp
memory/792-73-0x0000000002F70000-0x0000000002F71000-memory.dmp
memory/792-72-0x0000000002F80000-0x0000000002F81000-memory.dmp
memory/792-71-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/792-70-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/792-69-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/792-68-0x0000000002F40000-0x0000000002F41000-memory.dmp
memory/792-67-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/792-66-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/792-65-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/792-64-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/792-63-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/792-62-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/792-61-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/792-60-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/792-59-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/792-58-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/792-57-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/792-56-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/792-55-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/792-54-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/792-53-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/792-52-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/792-51-0x0000000002E00000-0x0000000002E01000-memory.dmp
memory/792-50-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
memory/792-49-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
memory/792-48-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/792-47-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/792-45-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/792-42-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/792-41-0x0000000002DD0000-0x0000000002DD1000-memory.dmp
memory/792-40-0x0000000002DB0000-0x0000000002DB1000-memory.dmp
memory/792-39-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
memory/792-38-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/792-37-0x0000000002D70000-0x0000000002D71000-memory.dmp
memory/792-36-0x0000000002D80000-0x0000000002D81000-memory.dmp
memory/792-35-0x0000000002D50000-0x0000000002D51000-memory.dmp
memory/792-34-0x0000000002D30000-0x0000000002D31000-memory.dmp
memory/792-33-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/792-32-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/792-31-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/792-30-0x0000000002D00000-0x0000000002D01000-memory.dmp
memory/792-29-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/792-28-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/792-27-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/792-26-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/792-25-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/792-24-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/792-23-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/792-22-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/792-21-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/792-14-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/792-13-0x00000000021E0000-0x00000000021E1000-memory.dmp
memory/792-12-0x0000000002190000-0x0000000002191000-memory.dmp
memory/792-11-0x0000000002180000-0x0000000002181000-memory.dmp
memory/792-10-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/792-93-0x0000000000400000-0x000000000043A000-memory.dmp
memory/792-94-0x0000000002110000-0x0000000002153000-memory.dmp
memory/1152-97-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1152-98-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1152-101-0x0000000000400000-0x0000000000401800-memory.dmp
memory/4036-46-0x0000000000400000-0x000000000040F000-memory.dmp
memory/4036-91-0x0000000000400000-0x000000000040F000-memory.dmp
memory/4036-99-0x0000000000400000-0x000000000040F000-memory.dmp