b060e4f0da7a3f1839e1c73d0757ba217527e0be51a4fc510b238ce03d74a259

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 30KB
Sample261013-2n92lsds3p
SHA256 b060e4f0da7a3f1839e1c73d0757ba217527e0be51a4fc510b238ce03d74a259
MD5 0f53f426381b2a158a4e5ed825eece73
SHA1 c207343febb80151b851a685bb7f8a478b685f3d
SHA512 e4c125fa59dd9ed824b471894441444a916b02ad719c75513a31088077e56a89e513ee68188621854ec3f64a7f66587c8d07841f26eb836b22ae473fdf795d08
SSDEEP 768:PY9YT5ngpVKLXK8UjVnLvRlrjbw5TzalePfqadDvTWUcHW+WfWHWSWIWxgWUW5Wo:8YT5ngpVKLXK8UjVnLvRlrjkdzalePfR
TLSH
T1E6D21B15B34FA23AEAFA4AB5B5746591847CD3318D6E83B1F488B0254E233CC8BF8075
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4252	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4676	4252	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 4676 wrote to memory of 4032	4676	vbc.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kkebciqb.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc1705381F8B814DE3B992FC8637EDC97.TMP"
    3⤵
    PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES70D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES70D1.tmp
Size 1KB
SHA256 6a47a6cc15b71742d67c47d8084f05ba26c620fdbd476995c9fc2aa9b5429d50
MD5 e2149c0ede8ede21b034b9717c98dcf8
SHA1 075ff116a8dff8b0a5ad0d38ee63e39b69be4c07
SHA512 eed426de1f75f8fce1794c6b7375a94f19a301d07f566fbf1c7c1523c28e5c76d39cc8c7eacaeef2cb4494693b30f8c5d7e8526fd5f59437166db344ed12154a
TLSH
T1D3212B0553E9470EF4B74731A9F6132B9639FEA4DFB2935B848053282C51544EF61E72
MD5 SHA1 SHA512 TLSH

Submit Download

kkebciqb.0.vb

Path C:\Users\Admin\AppData\Local\Temp\kkebciqb.0.vb
Size 20KB
SHA256 98a0a4e818bdd1e5fbb4146a9841c701e14341a4fe3c6743d76f21275cb84104
MD5 86eff40c23e453014ef4056937d4a7a7
SHA1 1d829a598faec1b4eb4d90c2f852c00590960742
SHA512 a152ea7381de37a122ce01ba72019d0dab32eebc8cefa57fa49e9ce3fc7c417645c1e2210033515abd6797b91cf06beed9c291053fdcdede20a9d3ded2185207
SSDEEP 384:hyYTHyKnRS4sBk9RWQSULXK8UjVnLv1AglrF9kWw50+za5Letdfqa0+LbD+fMe8A:gYT5ngpVKLXK8UjVnLvRlrjbw5Tzaleg
TLSH
T19792C415F30FB12EBAF94991B27868E1947CD3318D6E82B1F489B1654E632CC96FC0B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kkebciqb.cmdline

Path C:\Users\Admin\AppData\Local\Temp\kkebciqb.cmdline
Size 276B
SHA256 ce34fb15ce0703c46644a26da78993a378f073936229253d7dbfc9121e4c703e
MD5 e48df5f5ff3340754557db894d315bfc
SHA1 4b9602b4b07922b254054486ba05a594f8c86941
SHA512 dbe0140a224df6ce7d2549898b36f39268abb62ec632e1079a2d1c6c1a0b0941235f9a5124b2a49f88013da786d113672c14f51d45a846f6b300e325fe3b09cd
TLSH
T145D05B3B036EC7BC04D8140B44F5C9DC41F30B17254D7EF4A5C64948D72B49963F1916
MD5 SHA1 SHA512 TLSH

Submit Download

kkebciqb.dll

Path C:\Users\Admin\AppData\Local\Temp\kkebciqb.dll
Size 14KB
SHA256 c3d672c73468ba5b0eefc0cd7ed8253aaf14c57e8847dc0180bfce3a24f6d6d3
MD5 f6277e6c0004274fb574eb651564cb4e
SHA1 5cf2bbc201f18e3a070321e93ab9807376cffbed
SHA512 bdfaf9e5f18a011254b4ce5db3f83923043b33d94493d164d9d346f2f3cd23c967b8ee98ab1ae664d30dc8ea7d010b8dfcb902616cda0a7e539e4f453fcfc42a
SSDEEP 384:RhAFNxEMAQKGVvwsvAf+qA+CHsR4KOE+LLaWy9eHxOxF:0yTQxwKAmv1KOL49LX
TLSH
T1A2622A05B3F8421ACBFE0FB18D7175A652B1D7045E67E72E0C90E3AA19F37848A41672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vbc1705381F8B814DE3B992FC8637EDC97.TMP

Path C:\Users\Admin\AppData\Local\Temp\vbc1705381F8B814DE3B992FC8637EDC97.TMP
Size 652B
SHA256 d4efc55e8112a0144dc7ab92d301ebd422b2bff57cb0ad59986c96a343548f00
MD5 018dcbc4dce69bf96a460933e5ca7888
SHA1 6869d546dcc3454f674af6ebcfb391b8eaef6297
SHA512 3c71b43cc6edcccc5b41ebbd7d16225dc876cb9c0e915416d8f498690ddeba27ca82245c27099c13059301438222c9ea345bf16eeacbe2c39016e10802404e63
TLSH
T103F0540963F8420EF4F34B30BDF643A39569BD64EE3253ED1484131918645508A61F72
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4252-0-0x0000000001990000-0x00000000019A0000-memory.dmp

Download

memory/4252-1-0x0000000075252000-0x0000000075254000-memory.dmp

Download

memory/4676-7-0x0000000075250000-0x0000000075871000-memory.dmp

Download

memory/4676-15-0x0000000075250000-0x0000000075871000-memory.dmp

Download