21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 460KB
Sample261014-bjxmlstv9j
SHA256 21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c
MD5 30c03a328ef1ad9755d78633a74c3995
SHA1 dce43c87e85c147487633464ef08ee424161fe6b
SHA512 a3de410275a3939ecd1ebbf8eae6834c5e3f6c18fcc15944598dbf9aadcb22240ab5b12a264067ffec5c91fb948a0826604b8fde1ce9707c6af8986ae3171fd1
SSDEEP 12288:x7RwhbgTIXrUrYLmyLmV6SKLVtfPdQoHOO4V:ZRwhcTIW01SKLfPdQv
TLSH
T174A41204BA18D552C6993AFD982271D985B7DCAA5E31170674FE320E0FB20AFEDD072D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5612	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
5780	WindowsDef.exe
3068	WindowsDef.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	WindowsDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	WindowsDef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5788 set thread context of 5612	5788	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 5780 set thread context of 3068	5780	WindowsDef.exe	99

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2848	5612	WerFault.exe	90
5296	3068	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5788	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	5780	WindowsDef.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4896	5788	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	85
PID 4896 wrote to memory of 3792	4896	csc.exe	88
PID 5788 wrote to memory of 5612	5788	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 5780 wrote to memory of 2248	5780	WindowsDef.exe	96
PID 2248 wrote to memory of 368	2248	csc.exe	98
PID 5780 wrote to memory of 3068	5780	WindowsDef.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ke-g_ziy.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB40A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB409.tmp"
    3⤵
    PID:3792
- C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 12
    3⤵
    - Program crash
    PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5612 -ip 5612
1⤵
PID:5068

C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q-mev4td.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB90B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB90A.tmp"
    3⤵
    PID:368
- C:\Users\Admin\AppData\Roaming\WindowsDef.exe
  C:\Users\Admin\AppData\Roaming\WindowsDef.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 12
    3⤵
    - Program crash
    PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3068 -ip 3068
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB40A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB40A.tmp
Size 1KB
SHA256 32e4c76cf0b044e38b2d4ad287d9ac9f443d57aea5944922ae488708994740f2
MD5 e0150207433dc627ca6a50d2b1adfeac
SHA1 701478af5d2ef853e3538a514108dd0ddc97aee4
SHA512 5b6983767607a57360bcdab45df7b54a7c6510f68df95223073c8d0162afdb3db85427c980c4ec8da5dc93fe51ab22c3a7fef5a5f314d0af0e6e74d9d1b412ce
TLSH
T12221400553E8470EF0B74731B9F5532BA224FDA0DFB1675F844052282C61554DEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

RESB90B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB90B.tmp
Size 1KB
SHA256 e3f41b3123f290148ce443219472284e89d901c49afd21171bf91416c6c46588
MD5 cd1fd9b50e100d48bc95ab53cb3f0bd4
SHA1 b839fe4a1163aba9bdb7d83a96ba3422e1456fa3
SHA512 03ce740135cd50ab78e8d6753793e1989820ca12deeba42ff03ff60ce07a07682eb44c10f695e05f0c4a222dee87ae93cb49459ef4c5cc492ffc3f4312e55b47
TLSH
T13D21060593E8470AF0774B31A9F6532BA334FEA0DFA1A39E8490522D2C51514EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ke-g_ziy.dll

Path C:\Users\Admin\AppData\Local\Temp\ke-g_ziy.dll
Size 5KB
SHA256 de29a244b1663ea0f73972a2e604df2f526e0886ebba1f142570f00bb1af3a10
MD5 c1f7e7e7cc4e2ca7f5eaa51d6e7c5c43
SHA1 462641721726ab59fe1e8be4d0c1d6ed45a4b7c4
SHA512 2877f8a6422d4c4e211deb09b1e5e4ac7bbb03b7d9d77886b44a4aec5876af0ee7bb2441869dc668e47610214f10ef809e0660c9964dda0c2212bb6bf46c0045
SSDEEP 48:6k9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SRy5fHYXVFJtBjTDyni1ZQ40lTbU9LT2:z3A7lJ5Rn6yMhaZMRmQTzM40lYLIBK
TLSH
T146C1714B9BDCC25BE9EE4338B9BB0B5257B1E4214BB3472F05C09179ACF23705B61269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q-mev4td.dll

Path C:\Users\Admin\AppData\Local\Temp\q-mev4td.dll
Size 5KB
SHA256 715bea15cdcccd3cd7aee5503e8d41b686a326a0ce73ddcd2a1319e6c3455d3a
MD5 21473267e26edcec79b154d11b203748
SHA1 ba8964b6b8e8fd1fc770ff892459b640648806d3
SHA512 af29b6a24fe831716cba7abadd7c49d7d6e76dbf69548fea48511f6021a21ab06e1539deb3a954843707c9f6cc10fbeb53eaa217132e1c06f1c245308f0d48e5
SSDEEP 48:6v9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SR0K5fHYXVFJABjTDyni1ZQ40lTbU9qk:Q3A7lJ5Rn6yMhaZMRtQ8zM40lYq+EK
TLSH
T1C3C183475BDCC25BE8EE0338B9AB0B5257B1E4214BB3472F05C0907D6CB13705B616A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDef.exe

Path C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
Size 460KB
SHA256 21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c
MD5 30c03a328ef1ad9755d78633a74c3995
SHA1 dce43c87e85c147487633464ef08ee424161fe6b
SHA512 a3de410275a3939ecd1ebbf8eae6834c5e3f6c18fcc15944598dbf9aadcb22240ab5b12a264067ffec5c91fb948a0826604b8fde1ce9707c6af8986ae3171fd1
SSDEEP 12288:x7RwhbgTIXrUrYLmyLmV6SKLVtfPdQoHOO4V:ZRwhcTIW01SKLfPdQv
TLSH
T174A41204BA18D552C6993AFD982271D985B7DCAA5E31170674FE320E0FB20AFEDD072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Path C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 6KB
SHA256 2cbdc0ddc7901a9b89615cc338f63e1800f864db431e7a7a85749f73cba0b383
MD5 d89fdbb4172cee2b2f41033e62c677d6
SHA1 c1917b579551f0915f1a0a8e8e3c7a6809284e6b
SHA512 48941f08ae00d342b52e3255b99ce36abb4e46a48075a760869bc86b1a32c0737eb2bd5e43d5ee665303ab134282f9732738755c4027043ed2d4f414faab63ed
SSDEEP 96:ca8H0atNNNXlQ4S+MriK+n/4PiPFqGXfyMDB:R8H06Hg+vpfyQB
TLSH
T188C1B563B0279E63D7365970019AA675B632F1351E6A822FDF64D6386137C603E0C70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCB409.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB409.tmp
Size 652B
SHA256 619a73f298c181a764dc794f88a89a0ff9abf22252153a2029a1c4b64988e760
MD5 0c7e99b3e34eaa334098e833fcb7d742
SHA1 f1c7484fcef87db9568d92090c2e56a696e0c14f
SHA512 a107456342962f623d4973d96305e8fcf937154e02eac9b884b7b46e5f0ec8ea64db1675fc17580c89510157046c0f16e730f0199844fc36b8ac90642dad198b
TLSH
T1DDF05E0AA3F8020EF4F34B30BDF6436391A8BC64DE3293ED1440131928645208A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB90A.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB90A.tmp
Size 652B
SHA256 a31029cd32ff3e54bb241325ad3c8e9ed014f47e424b5c4ce5e41e5d212756f8
MD5 3c73a9cc76535cb913eaf0ffbe0ac859
SHA1 dff9d584c5999949cc7cdff7906a35af9d0f9799
SHA512 90eed84595868955d0e934a2ce86da741e92916706a3cbeec352c6b40bebbd3c5c8ca24044fc229a32b9c0b898c24c1156de0e01f95623a3d381e9d60e88a327
TLSH
T149F05E0963FC520EF0F34B30BDF6836392A9BC65DE3293ED1454131D2C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ke-g_ziy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ke-g_ziy.0.cs
Size 5KB
SHA256 922ec415710a6e1465ed8553838ddf19c8deb32b75da6dfaca372c1067d2d743
MD5 cb25540570735d26bf391e8b54579396
SHA1 135651d49409214d21348bb879f7973384a7a8cb
SHA512 553ce9d3647b196ccbd6612c06d301afac992130ec5c80fe8fa8a42bab4250053fad651227ff97d9fab4ba8aaff562d421236dc0b2b5d0d4a17430985dd07080
SSDEEP 48:J1oVrRWEmVrLyNrRh5orROzRs+/Xa+0j0lMYuoEXLrI5L77sUdQ0R9oOcJcrCHG+:J1oU5yrfM0lMdwLV2hHrAgW92
TLSH
T1FDB134180A14D30015F6222EEECA835DFA5350372FFE6A25B8BC51311FB61A4D37AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ke-g_ziy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ke-g_ziy.cmdline
Size 206B
SHA256 fbf09be6091df73ccaac7d5575189b31fcf6da14a052d9ffb077d240a6b6d7b7
MD5 68def5e4bfc9d0eea2e3ce3535ac91d3
SHA1 c70350bd1181b8dba9b12ba86142cd7c64e7b0b9
SHA512 ff16b1adf4c32ae8d709d145109c4fea00238fb64e10319929f7133a33d96b4df9ba76eb169a01f350d8d7a9bbd780814f07d358bff1df29c2e8067f7d130f51
TLSH
T122D02226039EC63C19E8000B5EF1C5EC82F3DA0A2D097F684240848CD17B08CB3E1712
MD5 SHA1 SHA512 TLSH

Submit Download

q-mev4td.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\q-mev4td.cmdline
Size 206B
SHA256 d77f2fd72fb27dfbe0dad2c873bb4127abf641a0e32c42fab18ca12f10949ea9
MD5 1b0a6f1a5354fb382d421eda2cd2cce9
SHA1 92deebb2840835f102c49e5a76211a98f3b16cc0
SHA512 e89f37b050fa44bfdcfa99884eb2f9d95690506ab50c2cb4ee8c8b689f69a5aef046fd0b9817028defcd60b0aa53e2365a8e60f06bc761cd81f2900755d66635
TLSH
T143D02226178EC63C95F8800B18E0C1EC82B24A1A2D8A3FE84340840C1133B88F3E1702
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2248-31-0x00000000022D0000-0x00000000022E0000-memory.dmp

Download

memory/4896-15-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/4896-10-0x0000000074DC0000-0x0000000075371000-memory.dmp

Download

memory/5780-23-0x0000000074D70000-0x0000000074E0F000-memory.dmp

Download

memory/5780-41-0x0000000074D70000-0x0000000074E0F000-memory.dmp

Download

memory/5788-0-0x0000000000D70000-0x0000000000D80000-memory.dmp

Download

memory/5788-1-0x0000000074DC2000-0x0000000074DC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads