2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 08:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe
Size 255KB
Sample261012-jyz1aaaa39
SHA256 2175329f4ed46df9f13ed8b80ffbe82ae4df5c24323ab50a1c197ab51b36ae78
MD5 ed441acec18afa29fe57d4b9e66ba126
SHA1 ee063b1146b855dc5f276228918fe0dee35c15cc
SHA512 9c64de1d74eebc52ccde7d0cd40dc3d40c15d3c25f0852ef4959b9a42022eaab80ae91d2922cd37be80af6407889f8bb5fcab6042f7378469d4c0fa7f32bf391
SSDEEP 6144:j+bxZqpbDY+SbL176/3Dc4qTjv7vzxY89zij5iiPDDjUr:j+KpbDYBR6bDKv7ra8oiODjUr
TLSH
T15B440208E7E9D063F9B34B312979C4625FBEF8102875525F9720EE4D3C3669AD41A336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe
5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe
5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5564 set thread context of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88
PID 5564 wrote to memory of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88
PID 5564 wrote to memory of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88
PID 5564 wrote to memory of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88
PID 5564 wrote to memory of 2856	5564	jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.GenericCryptor.jnu.exe"
  2⤵
  PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

isogamy.dll

Path C:\Users\Admin\AppData\Local\Temp\isogamy.dll
Size 84KB
SHA256 28d518d8ff4e62b02b31d605f7285d57d9ffae62d49141278f9b8cb9c373adbc
MD5 e156b330371d62e2820b2613ca5c05ff
SHA1 b91d5b78944428c1f3e9ea47cb94708a602752fe
SHA512 84f7d48ca9e8794750edd07fe70d55e90d5261a56ecd2b75c27f7df4b7dd0d24aad94ccf4db5d8d205dcea3b00900f6eb4f53c97ff48201eda477b810954e631
SSDEEP 768:QL7TmGP76rtOwAC5j9HFxePrrFyscYuRArf9rka5Kg8X0e/LnFxp:QLnertzAC5xHODrosfT55M0e/Lnx
TLSH
T17883B710F6E5C3D1D0FB2E795072923A4624FC1D5A31831ADF93728E393AF01A9A9B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu9969.tmp\System.dll
Size 11KB
SHA256 4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
MD5 3e6bf00b3ac976122f982ae2aadb1c51
SHA1 caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA512 1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
SSDEEP 192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
TLSH
T1C5325C12135081F3E4918138C86B3A276B6A15029BF98E57DFD39546BE31BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH