ad9e4988ad196f665eeba3d8e8dba518b0ee641e5d156466aad7d334bd56b383

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 21:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
Size 158KB
Sample261009-zxt1mscs4j
SHA256 ad9e4988ad196f665eeba3d8e8dba518b0ee641e5d156466aad7d334bd56b383
MD5 64b8837059b17312b7f60cd19a8850dc
SHA1 21881b864cbf3b2e44037f5be6838fa03bd61d53
SHA512 8a98ad16c6a2932058bb94715bdd01e9b786d94e3462b297b146dbf4c36aee86b5c375bc69d2b11f8a578d38c69c2466814adde31f7fface4644a803bf0e0e01
SSDEEP 3072:lSITVimRkXMqLvIP75rTTK/h4KtBfqXKPRPRU6/OYqF3+8/xHvd:ljZi1DETTq7xPRU3P9
TLSH
T1B7F35C03B2E691B6E6F247700A361B95AABA7D305E20CE4F93447A1D1D31B42FE7435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5248	temp0007.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\temp0007.exe	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
File created	\??\c:\windows\system\mswinsck.ocx	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
File opened for modification	\??\c:\windows\system\mswinsck.ocx	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0007.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
5248	temp0007.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 5248	2612	jaffacakes118_Trojan-Dropper.Win32.VB.d.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.VB.d.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2612
- \??\c:\windows\temp0007.exe
  c:\windows\temp0007.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mswinsck.ocx

Path C:\Windows\Temp\mswinsck.ocx
Size 106KB
SHA256 eba048e3a9cb11671d0e3c5a0b243b304d421762361fe24fd5ea08cb66704b09
MD5 3d8fd62d17a44221e07d5c535950449b
SHA1 6c9d2ecdd7c2d1b9660d342e2b95a82229486d27
SHA512 501e22a0f99e18f6405356184506bc5849adc2c1df3bdee71f2b4514ab0e3e36673b4aecbd615d24ebb4be5a28570b2a6f80bd52331edb658f7a5f5a9d686d10
SSDEEP 3072:YXMqLvIP75rTTK/h4KtBfqXKPRPRU6/OYqF3+8/xHvd:YDETTq7xPRU3P9
TLSH
T10CB35B02B3E681B2D6F21B300A361B55EBBABC246D31894F8354764D1D71B95FE3836B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp0007.exe

Path C:\Windows\temp0007.exe
Size 32KB
SHA256 986c92fda5759d1875fc978c4d36515ff213d943b26bed335524f3f02cfe4cb8
MD5 98ebecf784f45e85730a138a3022e11e
SHA1 f2ff9ddb5460d20d4843be5a206fba691f4f1e78
SHA512 2ffb93b48109b4acea98e84147fc34422e896d701ae7bd129620a45e2417712b4ab1df5bac000e9342a8814985992e7766859ba6e53e9fdfcc5e5fe9a79668a3
SSDEEP 384:/TCTpf8S5T7tGZfnrNOD5KqI/eVHLO37O5CB6+3x4FDp0Sfr:/k5PtcRyj6eVimCuF1f
TLSH
T1D7E2A313F968906BF255C2F2493689AA29173D3157508E4B778D7E2C2E32683BDE070F
MD5 SHA1 SHA512 SSDEEP TLSH