Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 00:53
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 93KB
- Sample261014-a8pgvsdy21
- SHA256 e92f50e73487656ca911cb3901bbaa79df2cda60943924087a829b849ec0e786
- MD5 2d9cde72dff6adcdaefcd1594871f9a2
- SHA1 597db285d49b0e69b85db87a54a855e3ed3bd57b
- SHA512 7dcd668c549a7ab0316d6a55be86554ff64a114254d6f84eb90bd6a461c5b244d482b43b97376c0b2cebf5eaffb67b298c43d7812b46b8b3ed396cf69da62b5b
- SSDEEP 1536:++5edxQJ9waK7jh7CQjEwzGi1dDoDNgS:++0QJ9waK7jtCBi1dGa
- TLSH T17493D84977E52524E0BF66F79471B2004E34F48B1612E39D58F219AA1B33AC44F89FEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 3388 netsh.exe 2516 netsh.exe 5404 netsh.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe jaffacakes118_HEUR.Trojan.Win32.Generic.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4680 wrote to memory of 3388 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 4680 wrote to memory of 2516 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 91 PID 4680 wrote to memory of 5404 4680 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Creates a file in the Startup directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" "jaffacakes118_HEUR.Trojan.Win32.Generic.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3388
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2516
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" "jaffacakes118_HEUR.Trojan.Win32.Generic.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5404
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1