5bcecd1a31f9fe6d2a2bd8411b8ac45f33526d87969f3c6178dcdd9ab7c2fa9a

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 196KB
Sample261014-b2b4maes3w
SHA256 5bcecd1a31f9fe6d2a2bd8411b8ac45f33526d87969f3c6178dcdd9ab7c2fa9a
MD5 3a1697e19b9e98940d5ec85d18f37703
SHA1 20c676ca99fe9b173fc1b4e75b3106708e05c6d2
SHA512 bfc11293f4ef6e305d96596dc6910d3302eef98e98a05fdd302251d442264b9f1bc199647628f46be12d76a60f0628c51e7bc52bbcecd919bd65c7811ae8d2c1
SSDEEP 3072:v83z9VZOwfzpwg0l2MY/HC2H1dyLNmg55zU3PH5Fwj:vUqAVwrRYvloB5hU3P
TLSH
T109148D10A640CC7BD5AA007588EFCB3A5E2DB871075894C7B7E98EA70E712E59F3174B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4128	svchost.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\smart\10027.jpg	rundll32.exe
File opened for modification	C:\Program Files (x86)\smart\10027.jpg	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
912	5024	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeBackupPrivilege	5024	rundll32.exe
Token: SeRestorePrivilege	5024	rundll32.exe
Token: SeBackupPrivilege	5024	rundll32.exe
Token: SeRestorePrivilege	5024	rundll32.exe
Token: SeBackupPrivilege	5024	rundll32.exe
Token: SeRestorePrivilege	5024	rundll32.exe
Token: SeBackupPrivilege	5024	rundll32.exe
Token: SeRestorePrivilege	5024	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 5024	4672	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 640
    3⤵
    - Program crash
    PID:912

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k imgsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5024 -ip 5024
1⤵
PID:1364

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k imgsvc
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10027.jpg

Path \??\c:\program files (x86)\smart\10027.jpg
Size 11.6MB
SHA256 b8f4c2e76011eb4ecdbda3ee98c515cc8dfa5deffa7dd11fb085b683ed2b7a1b
MD5 a4757910191036cf0a45282af5f0d443
SHA1 7ff7f898b1c930b3ddcea1534c80ad3611f493a9
SHA512 f433e7e31cfb9664fabe4c7b778340263fc01c3a47075939559cf195219569f8d4818edc43e2cd0e3eb1ebb66b273da953b1cf8b51567cf3d887c0e737a2e2a7
SSDEEP 6144:vUqAVwrRYvloB5hU3PYccccccccccccccccccccccccccccccccccccccccccccZ:bAar+loB524
TLSH
T113C6D09C267989D5D3EE0D3AA41632990BD43917B2DDE311400B683A27E33A1BDDC7BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-5-0x0000000010000000-0x0000000010036000-memory.dmp

Download

memory/4128-7-0x0000000010000000-0x0000000010036000-memory.dmp

Download

memory/5024-0-0x0000000010000000-0x0000000010036000-memory.dmp

Download

memory/5024-6-0x0000000010000000-0x0000000010036000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads