7edc4d87e11b2fda4d03e2ea83fb027579c31f1a0adb7733ed466e8cfcbf7828

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 112KB
Sample261013-3absbssv2p
SHA256 7edc4d87e11b2fda4d03e2ea83fb027579c31f1a0adb7733ed466e8cfcbf7828
MD5 1914d28071ad502883a34d16fc860fa2
SHA1 5902326de910075bdc474be6d6550dc6b280b3d4
SHA512 f8b54e202d4f538fbfb3ef815b68d9dd1a29ae108a2ad1d1fd80676edd668ecf721390be1606c5be2ecdb55a99b05d41a25cbf1d23e15c514445b5d61fb747df
SSDEEP 1536:+3cWonTjrwBSxfUzUAebPMqeOhe8ITM+lSWbP8PrPlHFKkZsjXwcgVbgpxoYXo4v:+Ro7W2MoAerMhOXFrPlH3ZsL4m7tb
TLSH
T1A0B37E92E288C432CFEF2E7466257B5EA7B870DACE5787208C5E7C9354EC511614E8E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2248	DBS.EXE
1996	DBS.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 3804	2248	DBS.EXE	89
PID 1996 set thread context of 1088	1996	DBS.EXE	95

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DBS.EXE	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Program Files\DBS.EXE	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	userinit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBS.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	2248	DBS.EXE
Token: SeDebugPrivilege	3804	userinit.exe
Token: SeDebugPrivilege	1996	DBS.EXE
Token: SeDebugPrivilege	1088	userinit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2248	2600	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 2248 wrote to memory of 3804	2248	DBS.EXE	89
PID 2248 wrote to memory of 3804	2248	DBS.EXE	89
PID 2600 wrote to memory of 3356	2600	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	91
PID 1996 wrote to memory of 1088	1996	DBS.EXE	95
PID 1996 wrote to memory of 1088	1996	DBS.EXE	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files\DBS.EXE
  "C:\Program Files\DBS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\SYSTEM32\userinit.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356

C:\Program Files\DBS.EXE
"C:\Program Files\DBS.EXE"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\userinit.exe
  C:\Windows\SYSTEM32\userinit.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DBS.EXE

Path C:\Program Files\DBS.EXE
Size 112KB
SHA256 7edc4d87e11b2fda4d03e2ea83fb027579c31f1a0adb7733ed466e8cfcbf7828
MD5 1914d28071ad502883a34d16fc860fa2
SHA1 5902326de910075bdc474be6d6550dc6b280b3d4
SHA512 f8b54e202d4f538fbfb3ef815b68d9dd1a29ae108a2ad1d1fd80676edd668ecf721390be1606c5be2ecdb55a99b05d41a25cbf1d23e15c514445b5d61fb747df
SSDEEP 1536:+3cWonTjrwBSxfUzUAebPMqeOhe8ITM+lSWbP8PrPlHFKkZsjXwcgVbgpxoYXo4v:+Ro7W2MoAerMhOXFrPlH3ZsL4m7tb
TLSH
T1A0B37E92E288C432CFEF2E7466257B5EA7B870DACE5787208C5E7C9354EC511614E8E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-15-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/1088-16-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/1088-17-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/1996-14-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/2248-7-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/2600-0-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/2600-9-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3804-3-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3804-4-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3804-5-0x0000000010000000-0x0000000010024000-memory.dmp

Download

memory/3804-2-0x0000000010000000-0x0000000010024000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads