Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 20:51
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe
- Size 914KB
- Sample261009-znaweaev51
- SHA256 38c89ddc6c1cb416cefad2ab08ec252f06668d346ba3a07bbd40669703808aaa
- MD5 6b3fa5a897059f9b2c3d78d2b0860f3c
- SHA1 15a97a1db837037c7d1326eb4b6d2f3d038b5c3b
- SHA512 cfdb9847fd1517f3bb3d3c282558d7bbe3dc1d8966080969eae3f3a4df1729187a7c0fcdafb0b1ece191dee8683eb0718ed1ec4d2c80055f2406696eb03fce7d
- SSDEEP 24576:M1tYSfnYUxEe93GtGhTvycmQa6H/29kfNR3h9:M1bfnYeMYtvsF6HlfNR3h
- TLSH T19A1523439FA4C5B9D9D50C7021FF72DECC758CE92A959429F30AE3A62970B87C52D223
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a00000001b86f-12.dat acprotect behavioral2/files/0x001500000001c428-22.dat acprotect - Loads dropped DLL 10 IoCs
pid Process 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\COMDLG32.OCX jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe File created C:\Windows\SysWOW64\Ri.ocx jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe File created C:\Windows\SysWOW64\unicows.dll jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe File created C:\Windows\SysWOW64\actskin4.ocx jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe File created C:\Windows\SysWOW64\Mscomctl.ocx jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe -
resource yara_rule behavioral2/memory/3752-0-0x0000000000400000-0x0000000000512000-memory.dmp upx behavioral2/files/0x000a00000001b86f-12.dat upx behavioral2/memory/3752-14-0x0000000010000000-0x0000000010010000-memory.dmp upx behavioral2/files/0x001500000001c428-22.dat upx behavioral2/memory/3752-24-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-32-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-41-0x0000000003420000-0x0000000003430000-memory.dmp upx behavioral2/memory/3752-45-0x0000000000400000-0x0000000000512000-memory.dmp upx behavioral2/memory/3752-46-0x0000000010000000-0x0000000010010000-memory.dmp upx behavioral2/memory/3752-47-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-48-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-50-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-53-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-56-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-59-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-62-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-65-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-69-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-72-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-75-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-78-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-81-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-84-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-87-0x0000000010000000-0x0000000010076000-memory.dmp upx behavioral2/memory/3752-90-0x0000000010000000-0x0000000010076000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Colors jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID\ = "{1EFB6596-857C-11D1-B16A-00C0F0283628}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9043C87-F6F2-101A-A3C9-08002B2F49FB}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C406F816-318D-4F7D-81CB-BA93CA7B70D5}\InprocServer32\ = "C:\\Windows\\SysWow64\\actskin4.ocx" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\ProgID jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F9043C88-F6F2-101A-A3C9-08002B2F49FB}\1.2\HELPDIR\ jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3FC950C-7583-4377-BAD8-EFBEAA33273C} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ = "Microsoft TabStrip Control 6.0 (SP6)" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\ToolboxBitmap32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A2-8586-11D1-B16A-00C0F0283628}\ = "IStatusBarEvents" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68F45444-3569-11D7-90A8-00E0297F0885}\ = "_DReplaceIconEvents" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\REPLACEICONX.ReplaceIconCtrl.1\CLSID\ = "{68F45445-3569-11D7-90A8-00E0297F0885}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5954EA75-9BFA-461A-BD34-CEA3A861FF19}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\actskin4.ocx, 119" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ = "DImageComboEvents" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin4.SkinLabel.1 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE5-8583-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7629CFA2-3FE5-101B-A3C9-08002B2F49FB}\ = "Common Dialog Open Property Page Object" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B87799AF-2CE9-4DAA-93CF-65F002035369}\TypeLib\ = "{90F3D7B3-92E7-44BA-B444-6A8E2A3BC375}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3FC950C-7583-4377-BAD8-EFBEAA33273C}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B87799AF-2CE9-4DAA-93CF-65F002035369} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl.2 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.ImageComboCtl" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA660-8594-11D1-B16A-00C0F0283628}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2\CLSID\ = "{C74190B6-8589-11D1-B16A-00C0F0283628}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Mscomctl.ocx, 16" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE5-8583-11D1-B16A-00C0F0283628}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE5-47EB-101B-A3C9-08002B2F49FB}\InprocServer32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9043C85-F6F2-101A-A3C9-08002B2F49FB}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\COMDLG32.OCX, 1" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{083039C2-13F4-11D1-8B7E-0000F8754DA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3FC950C-7583-4377-BAD8-EFBEAA33273C}\ProxyStubClsid32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4921908C-7090-4D37-A6B3-FC447F08378A}\TypeLib\Version = "1.0" jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0944D16C-D0F4-4389-982A-A085595A9EB3}\TypeLib jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\VersionIndependentProgID jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\ToolboxBitmap32 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C4F3BE3-47EB-101B-A3C9-08002B2F49FB} jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe 3752 jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.bj.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\COMDLG32.OCX
- Size 137KB
- SHA256 46f4fdb12c30742ff4607876d2f36cf432cdc7ec3d2c99097011448fc57e997c
- MD5 d76f0eab36f83a31d411aeaf70da7396
- SHA1 9bc145b54500fb6fbea9be61fbdd90f65fd1bc14
- SHA512 9c22bc6b2e7dbcd344809085894b768cfa76e8512062c5bbf3caeaa2771c6b7ce128bd5a0b6e385a5da777d0d822a5b2191773cc0ddb05abe1fa935fa853d79d
- SSDEEP 3072:VESIiWD8uq4hCqUt6mqD1gRshBgH/voqJrwo2CocrJbQN6N2TRqEydzXS0:VETz566VgRyOJ0oDxQRHf
- TLSH T1B6D31A9273F66222E4B73B302A7A27A06EBABC515D35D50F6710724D0872AD0DE74F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Mscomctl.ocx
- Size 1.0MB
- SHA256 bc58d624ceea02ab086f1cce809c992bf5a7105e88931853317a2f5aa5afd6e4
- MD5 ecc7d7f0d3446de36045d1d9e964fafe
- SHA1 da6b0ec081d628c33b150327f3bd16d3b7fa4729
- SHA512 443de697be9886cd97235e6468f3a7f6bf11612711e54dba31431b0d9418672e1434e839ed50cacf28107f692f0c9d9d2f57d90e3a843d81015d459c180db632
- SSDEEP 24576:s0LiK1d6dxOehwsj5dC33M/jYVRDSfaF0gg1CVGO7oVtNKG:n6dAehwaY19G1u7+Ln
- TLSH T101355B0273E58022D1B726B0197B37B5ABB67F619D38E94F1B503A0E2931E81DE35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Ri.ocx
- Size 15KB
- SHA256 46aab97ffb801d365f20bdae78a88f6a93ba6bbe135c741675e3db429535c95e
- MD5 a35283390521c175f91ec7bd200ee266
- SHA1 f41976a8fd8c388165a49978b8d682c55d6a4170
- SHA512 39e7a7d04faf8203ee4c5d47b813d2f70284901098ad189fee5e7dbbf96b564016fda70dd5eceb985cd186ab9676bc9cf92601e4ec4887c0371ddee6127a205e
- SSDEEP 384:2IRM95jCkpMiRMNaHeJ4fRXIjZ1WF7vmYg3E:nMrjnMUHz6ljBE
- TLSH T1B6629E92B7A6C49AE8929AB01DBA8BC59026FD410D2DCA0FBD94378F3C71374CE55630
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\actskin4.ocx
- Size 202KB
- SHA256 3bb2302d5f570a8b066437213f92353765f3ffb7cec7b5ecf91c7d784bc63040
- MD5 371592f449eea211113cc28acb52ba6b
- SHA1 b04e704c83af39edbdedf48b8edfee7a62931512
- SHA512 3bfdf90fa042dec96a88f63331232fff1db06eb51f0602624d9e7b3474d3744ce089e893b70cd3ff24a59c1034466b57b2fe3b70550f3082f2d09c0bacfda06b
- SSDEEP 3072:0iSt2n3OlfcdxMOWfKVZvcGjENXzjD79GnMlFeu62qFDTr:08n3CfUzXZjCjf79GnMTvQD
- TLSH T144147C92B744C7B7C0190230696FA3C29FB5E4551E15BBB6238892AE5DF33D237532E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\unicows.dll
- Size 240KB
- SHA256 a491c11f667fda3fb3311f6221bca15e4da159df4c12f7a7a0cfbf99f2b7c60b
- MD5 006401678cfbccbcb97e405e2f83d2fa
- SHA1 0976db1b5b9aa69e77fa25c35c8189e3ef851ffc
- SHA512 ef24dd6c6781c843a9730622f44d260e8db4fc365726aa918805d336c1f25659cf43df7400efd4307da3cca54c2e9c4f4cfbf3c10d974d37a4033c9624cc8d92
- SSDEEP 6144:3+zSDvZB9bZQ+tbAOgQm3uldxnE5x/htk+gq:jD4OgQm+plq
- TLSH T1DE344B86F8C4DC83DA673379BDA0FB75A7AB8B241538F94646DC4E4F26B128153BC241
- MD5 SHA1 SHA512 SSDEEP TLSH