95c82999bed4fdf0a2e299c31052a5eb3b1851aa51d7fbc70122cb9ee7bd551e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 245KB
Sample261013-2py1qs118j
SHA256 95c82999bed4fdf0a2e299c31052a5eb3b1851aa51d7fbc70122cb9ee7bd551e
MD5 0f7deb9c45d9ce73fe4dd541e4f6d3f9
SHA1 2713ef24ad3c9fb0952682769fd6b82547c0a72d
SHA512 4ad0cfec93d9d74c714754778487713afeef9d546acca8f6aa8e41b71fc9f757465c5d3185cf55369168beb99eb416a7ded0892a896b87d33d760e2adce3dbf4
SSDEEP 6144:Svbb/bpCvvdHilA0gw908e3ZYUStzeDLXEoZ7eO:G7qdHilA2W3uUyzOH
TLSH
T10234123BDB09AE50ED3172320E3E8B369579B412E42C9D67EED49D0C1967A268670335
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	6052	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 6132	6052	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c move "~@fs851aa623" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~@fs851aa623

Path C:\Users\Admin\AppData\Local\Temp\~@fs851aa623
Size 245KB
SHA256 8f099645aad4fe4499d5a9f0c3ad6a0ec7a415600ff78e5e3ea4b4c8c6c372cf
MD5 4dddfddd6fbee7b70a043f9adcfa6c7f
SHA1 6340654a722d8b64b12f46dc74225ba899b40a6b
SHA512 431124e6ddcaff1410098c1ef8c9be26545e533d8dca19e958867d8f7a550fc56f8366a97122f5150d495f7f003e22ee90d4595ecc7fa0afcbf47d9206f6aac5
SSDEEP 6144:db/bpCvvdHilA0gw908e3ZYUStzeDLXEoZ7eO:dqdHilA2W3uUyzOH
TLSH
T10334123BEB09AE50DC31B2334E7E8E169579F423E83C9967DDE51D0C2997A260670339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download