37301de6d2f04e06db10b804a8991ae8fd8aa3d8696c65f03cb39c4bc561e45b

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 81KB
Sample261013-1wjnystyhs
SHA256 37301de6d2f04e06db10b804a8991ae8fd8aa3d8696c65f03cb39c4bc561e45b
MD5 08f913a3a04fa745f2bde4b854b45204
SHA1 82860157d6fb0d9475d5fc54fca38e2c95a4ad03
SHA512 4d754dfcc7e388e1e179b7767d9fbcbb496b0e044f5455f7e325bd427874cfabdaf927b8cc70e040ab82e45644a2a850ce4cf80d448811e5ca1ddefb7b459acc
SSDEEP 1536:baf8tGBcCSyh1Psao0racgadlXtiAb4XsO:bo87+h1Uo3d/hKsO
TLSH
T1F883CF51F72D1BAAE7234DBBC572320286FD90DC9045F2954F857A618AC23739D336E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4552	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4552	3152	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c echo @echo off>"sd.bat"&echo :try>>"sd.bat"&echo @del /F /Q "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe">>"sd.bat"&echo if exist "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" goto try>>"sd.bat"&"sd.bat"&@del /F /Q "sd.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sd.bat

Path C:\Users\Admin\AppData\Local\Temp\sd.bat
Size 208B
SHA256 48734fb87c4a1c14f28aa27379bcbdbfb95911603d34afd4050dd857af7120f7
MD5 18787a3686e59d29d54f45e594ea726a
SHA1 5833b1aad062871c6ca7a9f62db660a9e1b9b8ef
SHA512 195d4b2685cc67c86d897211528e3dc4deefc22b3af3956a0e1236872cf364966112cb5196f6a9c885bf2796445d7c2940cd11fb8dfe0f3c1d712d926918e8f2
TLSH
T1ECD0A94281478B2908008C2B61748F8EE2A58A892AC83F740332C38883A340AF79A366
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3152-0-0x0000000000400000-0x000000000041B000-memory.dmp

Download