Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 21:36
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.dll
- Size 741KB
- Sample261011-1f72lsft9l
- SHA256 91380a7a5c716fbfd392cab177472616a2d439fe05321cf5ae5ba1df423985c0
- MD5 eebc522753066f234214d6f94ffe50f8
- SHA1 a72e2ddf90c02787497eb73b270d53d50e82206d
- SHA512 c257b73f1ea50a3e07dfec7da432aa7bafc2906de47f9c5aa4f70a44807e9ca6df8affe073070f596923cfde0a287354d80a36f179be04189fb5b3b2c34b31e3
- SSDEEP 3072:uZTvnyEZiGJ7/Qguiry/5s88888888888888888888888888888888888888888O:WBbJ7Giry/c
- TLSH T1F2F4C5FDD2B27384B070C5BC280777E5968D001B8A96D64BC2B0BE1593C9A5DCE6D6F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x001000000001c5c0-2.dat family_gh0strat - Loads dropped DLL 1 IoCs
pid Process 4104 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Yhxr\Drhifibeb.jpg rundll32.exe File created C:\Program Files (x86)\Yhxr\Drhifibeb.jpg rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 5596 rundll32.exe Token: SeRestorePrivilege 5596 rundll32.exe Token: SeBackupPrivilege 5596 rundll32.exe Token: SeRestorePrivilege 5596 rundll32.exe Token: SeBackupPrivilege 5596 rundll32.exe Token: SeRestorePrivilege 5596 rundll32.exe Token: SeBackupPrivilege 5596 rundll32.exe Token: SeRestorePrivilege 5596 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3892 wrote to memory of 5596 3892 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5596
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\c:\program files (x86)\yhxr\drhifibeb.jpg
- Size 6.2MB
- SHA256 e6159ed0b8c48a642930a1bda12fe076903f49e90544f405f680bc1734f8186c
- MD5 4b72efcf9d9f3c90cf9deecc877409c6
- SHA1 05ce9c8a5a597b786b4e70b5e8575fba5974813e
- SHA512 a52ef9e9ed6c1ae2ab4289d8f242d24c79e487c5d8889428d8164c5e1f2fd73cac0ed219bea7c19a0bdcf79acc5221515d66fce5fdef9143d0f4426745e602cd
- SSDEEP 3072:uZTvnyEZiGJ7/Qguiry/5s88888888888888888888888888888888888888888W:WBbJ7Giry/A
- TLSH T1CB668EEA412118A6F4A0E57CFD8B3AE4C05AC07B2D72A56787B5622FC34C769571F323
- MD5 SHA1 SHA512 SSDEEP TLSH
