Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 00:48
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.dll
- Size 21KB
- Sample261014-a56a7set9m
- SHA256 1a8539c868003c2ac0fdb96216df78ee81de5a7d41cf1e3670e2a7469de328b6
- MD5 2c9b1cf95c6a48ec67a7b6136854daad
- SHA1 62c810ec4b60be545f2359969122efbf4f178710
- SHA512 976769b16b2607da77a6a8b7a712c19deae2b913dad418542a7c6ccd50ad887ff33e534c848855586630745c7e4d1067bcac774ee8cd6c068d26eb2be4efe685
- SSDEEP 384:HLWCpCJ6x37z8MxLvLW9GhOEv+fmuhx+VqC0eWPpnwDL9ADemjx5uo:rzZhFxLDW9Gc9fmuhxKqCCyL93mP
- TLSH T1C7A2D053528AFD6BD720163A978E13A9335129B7521FA764EB77046B9DCE0C04C10A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Stops running service(s) 4 TTPs
-
resource yara_rule behavioral2/memory/1820-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1820-10-0x0000000000400000-0x000000000041F000-memory.dmp upx - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5056 sc.exe 1676 sc.exe 1112 sc.exe 3704 sc.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 rundll32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID rundll32.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1820 rundll32.exe Token: SeAuditPrivilege 4464 svchost.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1820 2692 rundll32.exe 88 PID 1820 wrote to memory of 3208 1820 rundll32.exe 90 PID 1820 wrote to memory of 5056 1820 rundll32.exe 92 PID 1820 wrote to memory of 1676 1820 rundll32.exe 94 PID 1820 wrote to memory of 1112 1820 rundll32.exe 96 PID 1820 wrote to memory of 3704 1820 rundll32.exe 99
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#12⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe import "C:\Users\Admin\imvp.avi"3⤵
- System Location Discovery: System Language Discovery
PID:3208
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe config PolicyAgent start=auto3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5056
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1676
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe start PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1112
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc.exe stop PolicyAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3704
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Drv.sys
- Size 3KB
- SHA256 d03f8ed69729bd95e178a1ddb6a7706fe9b0859daa1f04711abf18a67d8fcaa6
- MD5 a26b00ad888aa66727071bd0f0267758
- SHA1 50c3a7c38b49544f3d8fbfa094823a18ce9abec3
- SHA512 57a3836971d1fb0f512b8934ff4926b5f476e19985ba8c9db27317c50a707f0bb9c041e76744b4e73e417b0c4096e3a6b30a3ebee4fc80bd8d97b0ef8017eac8
- TLSH T1B57195D2A24967F2EA3CF4B04687369152B3BC50E296D7092933705F3E38364B0223DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\imvp.avi
- Size 56KB
- SHA256 59b9dc39d69f8b0aa350f550e42e632b396237865776d0ce75477f8fe3f9016f
- MD5 bc8025bc98da7f4ed891c9f9991d3ff1
- SHA1 70a69a7fcebe9b43f00a1fa713e3a0621bf3ac6d
- SHA512 7f772261e003d2df9162ae4aeaab2bda674ee2721b3300cc8b2a2f4904af6bc9c565c7f2c3e67a7394eb1a387860a2544fc5bdc3e6de384b664f8d232ad6acf5
- SSDEEP 384:TYC0Yj2XvJtOMJkjT0VAC9w5SSIf5GpbKV0VAC9w5SSIf5GpGp0VAC9w5SSIf5GN:TYCXgtzUK82UWnpUnmV9E8U5
- TLSH T17E433236DBA5205682F78D78CEF24067EE6A3907363CDC4E54C22F4A0A93E4D686175F
- MD5 SHA1 SHA512 SSDEEP TLSH