60137f35bb757db4e75792743252d9a4d029982c886536ace27aedc02162598f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 16KB
Sample261014-bc3v2swxdx
SHA256 60137f35bb757db4e75792743252d9a4d029982c886536ace27aedc02162598f
MD5 2ede7dde3163b6d26cd809019e5cb41e
SHA1 078ab1f1a50475e9440bd545774e563a2f6035dc
SHA512 9a3b6c04659c01d2abdfe83fc11fcf77320fb88e693e60b916576a99d33bdd19c42b114e3461a7f13941aa8bd1e80d147267f7bf38cadb916231866ff3dfccae
SSDEEP 192:I0H0G6wU1cpsNyV7SM4o4feeEEZpaHq49NIdYZ:IqxjU1cp7TweUpGqeIdYZ
TLSH
T1B1722D0E5D0B46A3F9040870E6C61AD24FFE8C2739C3797FEF45849169E014D4AE2EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5656	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 5656	2636	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\SysWOW64\WScript.exe
  WScript C:\Users\Admin\AppData\Local\Temp\240708656.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240708656.vbs

Path C:\Users\Admin\AppData\Local\Temp\240708656.vbs
Size 1KB
SHA256 5f0cda93581f11345c9940a0dff9d22c4bd25805b36a5488391f88d692f3f1db
MD5 d1a44ba288f859a9e572163364846cb8
SHA1 9fa2f7c5e2c14a9513c947438a4cd27f967662fa
SHA512 934c3d0052c33e67735b951ad56fbbf64a83da931adca11a5ae3a18b4ce6181f44e55c4bd0ef8a352dae7a22433e2e0861e7bb10d1bc2a28fd2a19d895221ae3
TLSH
T1FA31640EAD0FED364585F292F171682E5E041B192B2A5C38FF9D4899943988CC79A16A
MD5 SHA1 SHA512 TLSH

Submit Download