8b97e7db8e48dad922313738d79788e35736e89b3a41ab877b5ea918aba28f85

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 244KB
Sample261013-2hjbps1z8l
SHA256 8b97e7db8e48dad922313738d79788e35736e89b3a41ab877b5ea918aba28f85
MD5 0e39d5cabd830089ee32319e0c6a29b0
SHA1 89f788da6b49a0c06be9dee6a10c71aee5bbac7c
SHA512 b8c5731c995a106199ba55e28fd7ef990c009916b05edc5c0043c7f0a58c0045e2303780e79c4c9f4bf2ae440521ab0ab24a5af883f19e4d4d7bb9ac757e8272
SSDEEP 3072:MTw5/Y+7IXdeOnsrrEDNow0LdEWef1SJt:19rENovLTef18
TLSH
T1FB346F3E28B9162BC1B4C2B5CBD6857BF050E1AB31512E3A64C7576A471BE4339C313E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 4696	2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4696	2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2552 wrote to memory of 4696	2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2552 wrote to memory of 4696	2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2552 wrote to memory of 4696	2552	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4696-5-0x0000000000400000-0x0000000000408960-memory.dmp

Download

memory/4696-2-0x0000000000400000-0x0000000000409000-memory.dmp