21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 460KB
Sample261014-bjxmlstv9j
SHA256 21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c
MD5 30c03a328ef1ad9755d78633a74c3995
SHA1 dce43c87e85c147487633464ef08ee424161fe6b
SHA512 a3de410275a3939ecd1ebbf8eae6834c5e3f6c18fcc15944598dbf9aadcb22240ab5b12a264067ffec5c91fb948a0826604b8fde1ce9707c6af8986ae3171fd1
SSDEEP 12288:x7RwhbgTIXrUrYLmyLmV6SKLVtfPdQoHOO4V:ZRwhcTIW01SKLfPdQv
TLSH
T174A41204BA18D552C6993AFD982271D985B7DCAA5E31170674FE320E0FB20AFEDD072D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5624	WindowsDef.exe
5712	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
5832	WindowsDef.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	WindowsDef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsDef\\WindowsDef.exe"	WindowsDef.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5640 set thread context of 5712	5640	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	97
PID 5624 set thread context of 5832	5624	WindowsDef.exe	102

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4112	5712	WerFault.exe	97
5868	5832	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsDef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	5624	WindowsDef.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 5024	5640	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90
PID 5024 wrote to memory of 1412	5024	csc.exe	93
PID 5624 wrote to memory of 556	5624	WindowsDef.exe	95
PID 5640 wrote to memory of 5712	5640	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	97
PID 556 wrote to memory of 1768	556	csc.exe	100
PID 5624 wrote to memory of 5832	5624	WindowsDef.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lkvvse42.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5F5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF5F4.tmp"
    3⤵
    PID:1412
- C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  2⤵
  - Executes dropped EXE
  PID:5712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 16
    3⤵
    - Program crash
    PID:4112

C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-xd6wtub.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF9EC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF9EB.tmp"
    3⤵
    PID:1768
- C:\Users\Admin\AppData\Roaming\WindowsDef.exe
  C:\Users\Admin\AppData\Roaming\WindowsDef.exe
  2⤵
  - Executes dropped EXE
  PID:5832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 16
    3⤵
    - Program crash
    PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5712 -ip 5712
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5832 -ip 5832
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

-xd6wtub.dll

Path C:\Users\Admin\AppData\Local\Temp\-xd6wtub.dll
Size 5KB
SHA256 727e6a17086a942f6f0e05e54ee09b34da051b7d9adb2a1a7da317dd1b656631
MD5 8e9b849cbd69c06fafe5890ce5652f6c
SHA1 bbc0b8a2eeea5babce82550a211b82d863e86a3a
SHA512 55adc2e9b9b5126c63da66ef4ebfab904017a3cec1e26c3aa20acc00d3ecd5861899a7dfd65eae78076b9fa0d2e46290e2b69ccb7c2d082dd8c481b9b46746bc
SSDEEP 48:6J9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SRS5fHYXVFJ9BjTDyni1ZQ40lTbU9+FY:K3A7lJ5Rn6yMhaZMRGQjzM40lYZjK
TLSH
T105C181479BCCC257E9EE4338B9AB0B526771E4214FB3436F45C09079ACB23B05B21669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESF5F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF5F5.tmp
Size 1KB
SHA256 643f1e9038ab66bd668fd06969dd808a057fbe3e56d706f0c511734d901c7b02
MD5 ea9bf529483ec1c8a3e264f5afe2ee07
SHA1 c35e280cab98f134c0ccd330c212dd51ce90e60d
SHA512 5ce5ab09c14f11ca54104626f19c9d7615e366de095a96b177f3cc454762e4c3146f393d2c8219758f48809df4e819211af9884faa91be06689d85c7c8209519
TLSH
T1DD21060953E8460BF4B74B31B9FA532BA264FDA4DFA1639F858002282C51554EEF1A72
MD5 SHA1 SHA512 TLSH

Submit Download

RESF9EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF9EC.tmp
Size 1KB
SHA256 885526973bd2d7dcbfc004175d646866a3f66fc8e945450ac876d63bb7861e98
MD5 5c13b8226c986e99bd260b30e6b35af4
SHA1 fda71b7c1c528b6bccc892288c87dbec9917e845
SHA512 dcf41413f5c9e5c23098f621138750047f768fb2c250fdf011a4e67696d5f0de00912b994ec2de1f6163ec6f690851e3e4cb42e6b47e0c6991dc4b6d6db756db
TLSH
T196210A0563E8470AF0B74731A9F9532BA228FD64EF71939A858042681C51554DFB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

lkvvse42.dll

Path C:\Users\Admin\AppData\Local\Temp\lkvvse42.dll
Size 5KB
SHA256 3158c00c97c03ea4f9c36f62ef0d12c7399e11dcbd16860f7af3c1467b175386
MD5 95952e76548fd1abbefc3942d21e2359
SHA1 73fdba2882c5e382aac44b935cd6b24477600a80
SHA512 9ba00bf69cf0aa7ed1a31ffc1780dd01805eae52b3803c82ca4ac8c3ced132bf2bba95b22fd020cc73fb18262f123c579d599c35aa1dbc32bf6e6b78b9fdb6c3
SSDEEP 48:6e9vwgAO8AwWzqH665Rn6yMnhaZZmbf2SR3y5fHYXVFJVBjTDyni1ZQ40lTbU9TG:t3A7lJ5Rn6yMhaZMR2QLzM40lYIPK
TLSH
T183C1924B8BCDC257ECEE4338B9AB0B126771E4214BB3032F05C090397CB13B16B612A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsDef.exe

Path C:\Users\Admin\AppData\Roaming\WindowsDef\WindowsDef.exe
Size 460KB
SHA256 21ba0ff1035bc00bf0829b4e3386431e81c0e8eabdb7a7e05349d014c855794c
MD5 30c03a328ef1ad9755d78633a74c3995
SHA1 dce43c87e85c147487633464ef08ee424161fe6b
SHA512 a3de410275a3939ecd1ebbf8eae6834c5e3f6c18fcc15944598dbf9aadcb22240ab5b12a264067ffec5c91fb948a0826604b8fde1ce9707c6af8986ae3171fd1
SSDEEP 12288:x7RwhbgTIXrUrYLmyLmV6SKLVtfPdQoHOO4V:ZRwhcTIW01SKLfPdQv
TLSH
T174A41204BA18D552C6993AFD982271D985B7DCAA5E31170674FE320E0FB20AFEDD072D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Path C:\Users\Admin\AppData\Roaming\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 6KB
SHA256 2cbdc0ddc7901a9b89615cc338f63e1800f864db431e7a7a85749f73cba0b383
MD5 d89fdbb4172cee2b2f41033e62c677d6
SHA1 c1917b579551f0915f1a0a8e8e3c7a6809284e6b
SHA512 48941f08ae00d342b52e3255b99ce36abb4e46a48075a760869bc86b1a32c0737eb2bd5e43d5ee665303ab134282f9732738755c4027043ed2d4f414faab63ed
SSDEEP 96:ca8H0atNNNXlQ4S+MriK+n/4PiPFqGXfyMDB:R8H06Hg+vpfyQB
TLSH
T188C1B563B0279E63D7365970019AA675B632F1351E6A822FDF64D6386137C603E0C70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

-xd6wtub.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\-xd6wtub.cmdline
Size 206B
SHA256 edff4812b08cfce398fbf0a2d32b955b3e17e51b6d53055cd195f4315fc59409
MD5 76eb0c706f1f0ba5a3c9af1160ee3ef7
SHA1 a24718dce7921baae552feed552d7274355bbe18
SHA512 e32b47e170376748cfcd27fd84c6b486ab13d816ca1757c5a01ffca77de4a6fbf8cd635ce5892cff5364e46dfabe8ae0cfd674a91f59fe4e415981f80fffbcb3
TLSH
T1ABD022261B8EC66C29E8000B1AE4C2ECC2B24A1B2D853F6C4A40880F11330CCB3E1702
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF5F4.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCF5F4.tmp
Size 652B
SHA256 fc079ecd78d6cef7802fd9e74bceb5000053ebde59c6e6ffa2510d76975cce6d
MD5 79742e1989e9e92418849053facca785
SHA1 8d1cee6e0d23675f0c232bb57a38ea242eef58a5
SHA512 10751192cabb29968b3e78ee4d74627d714d17b7c63e48f5a04230b9cdb4deb03b2fdfcc4b653e6b4df7e5e661e4f2af89ecfc4793751fec2b5ee29d90eb8091
TLSH
T126F0544A63F8020EF4F74B30BDF543639168BCA4DE3253ED1480031D1C6451096B1F71
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF9EB.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCF9EB.tmp
Size 652B
SHA256 25320be43907c25dd9a0a85cde73055a67160d4aa3253cacbe1f63d4f6b55f29
MD5 337341aab7c80a623690372eff3f694e
SHA1 b8de7ae3ec6a8e975e99bdcd34f2437dca76ad9b
SHA512 aaaf633d9cd9edde11b5c32f466e8f9290f65832eeba44ad0796494dbdd142f282e42595abd486a67e2eee0d54bd16a2da5c2dce8081c952c3f052da46ac016d
TLSH
T159F0300A63F8020AF0F34B30B9F543A3A169FC65EE3293ED9440035D5C645108661F71
MD5 SHA1 SHA512 TLSH

Submit Download

lkvvse42.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lkvvse42.0.cs
Size 5KB
SHA256 922ec415710a6e1465ed8553838ddf19c8deb32b75da6dfaca372c1067d2d743
MD5 cb25540570735d26bf391e8b54579396
SHA1 135651d49409214d21348bb879f7973384a7a8cb
SHA512 553ce9d3647b196ccbd6612c06d301afac992130ec5c80fe8fa8a42bab4250053fad651227ff97d9fab4ba8aaff562d421236dc0b2b5d0d4a17430985dd07080
SSDEEP 48:J1oVrRWEmVrLyNrRh5orROzRs+/Xa+0j0lMYuoEXLrI5L77sUdQ0R9oOcJcrCHG+:J1oU5yrfM0lMdwLV2hHrAgW92
TLSH
T1FDB134180A14D30015F6222EEECA835DFA5350372FFE6A25B8BC51311FB61A4D37AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lkvvse42.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lkvvse42.cmdline
Size 206B
SHA256 5502ef01c56c50c4201038c86d60420b2f0a120807063a03072454438d58e745
MD5 1b6880d163fd1913eb6fd9e436882936
SHA1 54bff6bfd47c63c84abccbf7b426fa3631e9dbf4
SHA512 87ad12d5f3326491fef2ef9f6766d9d047d892404c2daa5c786eaf5bf0df276c99b67913ba570925fb079eac92ae13a31c76a25f4c257fe70c38a3766c6c213e
TLSH
T1BED02316078FC62D15D8C10750E1C1EC41714D073D073F6441504C4D213314573D1701
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-37-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/556-41-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5024-11-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5024-14-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5624-23-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5624-19-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5624-40-0x0000000075100000-0x0000000075721000-memory.dmp

Download

memory/5640-0-0x00000000010A0000-0x00000000010B0000-memory.dmp

Download

memory/5640-1-0x0000000075102000-0x0000000075104000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads