Analysis
- max time kernel
148s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe
- Size 37KB
- Sample261012-yaqh9set3v
- SHA256 14b0a3e1f427096ee581463136db4fb4f4485b72d25c7fd025b880600dfe8755
- MD5 b470b5a9bcb22a22af425b90a4470618
- SHA1 f1efbce5e12877a8ea46ad43913a49f8852a1443
- SHA512 040cff6bb6f3a4fe67ece571d416de18533bc6cc2003bd5a7dbc42085b6c092233b675299d1d01fce43badb6b4805d2478c49019f48b1cabb47fc79f4bc16fe7
- SSDEEP 768:ck2IlruH4eFUUG5uPZHx1gdgE3EP0xVRWn36vrDl:B2KruHrFUU8uPBgdgEUPAxjDl
- TLSH T1E1036C27B890D2F3C48245B5017D9B4A6F3B6116C3F422DBAB640A5DAF133E4993E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon = "C:\\Windows\\system32\\msmsgrs.exe" jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon = "C:\\Windows\\system32\\msmsgrs.exe" jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\_tmp9877 jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe File created C:\Windows\SysWOW64\_tmp9877 jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe File opened for modification C:\Windows\SysWOW64\msmsgrs.exe jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe File created C:\Windows\SysWOW64\msmsgrs.exe jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bnf.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\_tmp9877
- Size 1B
- SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
- MD5 cfcd208495d565ef66e7dff9f98764da
- SHA1 b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
- SHA512 31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99
- MD5 SHA1 SHA512