1478df4d69f780c58889d3449385a630a5a4b3a458c08192c8937caeea25eac6

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 25KB
Sample261014-b9ymlaea98
SHA256 1478df4d69f780c58889d3449385a630a5a4b3a458c08192c8937caeea25eac6
MD5 3b72f4c83c2cbcafeca9f956962a9eb8
SHA1 b80c8fe91675f95165c75dba4864776196a4b380
SHA512 8987e2b5a6dad7ac48562bc1f6247ea9bcb84d11d9d4524c911f1e4c2d94ed690e3a2fea69523bf7885b3dbfbe61d1be99aa3e6e68788c9bf32535d40cc961ee
SSDEEP 384:yNhowP2SjWkqX152EaHuf9Ip2cpmgezGpm+gGoD0YDHQ0aUGWg:Qh1ezlwEaaYpd4aUJAkw0a5
TLSH
T1EEB2D061A892A617F52CA9BB4240FDC8352E6E3453E473B69CD874FDE6120A0DF2934D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution upx

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:ext.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\SysWOW64\fci.exe.exe:ext.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5132 set thread context of 1260	5132	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5132-0-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1260-1-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1260-2-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/5132-8-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1260-6-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/1260-12-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3672	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2560	1260	WerFault.exe	88
4312	1260	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 1260	5132	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 5132 wrote to memory of 1260	5132	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 5132 wrote to memory of 3672	5132	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 308
    3⤵
    - Program crash
    PID:2560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 316
    3⤵
    - Program crash
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\6750211.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1260 -ip 1260
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 1260 -ip 1260
1⤵
PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6750211.bat

Path C:\Users\Admin\AppData\Local\Temp\6750211.bat
Size 249B
SHA256 31389e37bceb9e92745ed2d1ceaa660c40d3385dfe88345a22bf2c2703f4924b
MD5 2f1eec47d05dc3402ddbdee12501f92b
SHA1 69c551b4acf7180f05637edc1d9ff7071c91e150
SHA512 f40de56ae4f9fa3ad43fa4364578721e21b92a71649dab4ff629028007a622aca6d320cfbc2223104e86a759ebe1135a06de6772cc202b43debac768bfdbf49b
TLSH
T13FD0A5054143CB1D0450C83719349B4DD1984E9C26C43F340731C1C552F381E77D7755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1260-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1260-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1260-6-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1260-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5132-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5132-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads