5f2a9a5044b9b0df22e1370879343e1dee32cb55a97c7ac50e51dd0f678fd4d6

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 243KB
Sample261014-c4cnlsfs2q
SHA256 5f2a9a5044b9b0df22e1370879343e1dee32cb55a97c7ac50e51dd0f678fd4d6
MD5 49d24d2fd63fb0fe15c3c2d2ad34668b
SHA1 ea55ffc523e69e6a3a29c156df1d76b32f39839b
SHA512 c211f8190ecb42d04d7eb53a841fcee6f7818bac0a927e8ca4bdb91894c6d8020d89d7b561b2db331a6483ed8546b37eab231cf14ffe3a55e6d9a35a569fe58d
SSDEEP 3072:dVYryg9WwkGcw2F0S5R4/iZeHnrzYkRqDMMbAfv6RPmsXMNixlqM/r4wCebWVu:diryGkRgnvbUswsGp/8wCsa
TLSH
T13134F112374665BFD0638070457267F2DB9CA937A2164FCDA7CC1E6129298C6EA3C73B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2936	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
2936	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Canaveral = "rundll32.exe C:\\Windows\\system32\\sshnas21.dll,BackupReadW"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sshnas21.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5092	1888	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe
2936	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2936	1888	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Windows\system32\sshnas21.dll,BackupReadW
  2⤵
  - Badlisted process makes network request
  - Loads dropped DLL
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 636
  2⤵
  - Program crash
  PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1888 -ip 1888
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aB83A.tmp

Path C:\Users\Admin\AppData\Local\Temp\aB83A.tmp
Size 8KB
SHA256 cd3f786cb8262b86783ed297fb9df261aac9726747f1455f36d4336e06a0d00d
MD5 cba22b5ca94bcc667853425934bede21
SHA1 50e76595092c0b41d1fb134b8ec874c51d35776b
SHA512 5953ae213e2c641812a1e1c07becd03bca750e289c5c0860d39b8ae52a2f9f1d232e133fad0ad48b164ea5540786f64ba6bf3509b22964b58e87e3bf50a693ad
SSDEEP 192:8hgXoydFg1nHbDkWSVBgTuwpYem4ThG54CaG/wDr1D:9XoyHGHbDkWTuw1T4ttGD
TLSH
T174F1AF4B028ABC48C35DA0DED5D4D8B9598B732C798E3ED9FAAFC1BB4D958834205062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sshnas21.dll

Path C:\Windows\SysWOW64\sshnas21.dll
Size 205KB
SHA256 56c8e911752af475a565838aef79998ba024edda5a7c14f93055945e8b611b6a
MD5 754d8c176ec74636fc619d888197ebe4
SHA1 377c3a43f7d422d8ddaf87ae3a135eb670be2377
SHA512 f9fae46165e3eb63eb679df93bd05c344f931772db88b06a7597aa436af3768c14af466988cc4d4e2b3a387c6bd4ba1bfedb1101c85e5da87978fbc4af6b2a9d
SSDEEP 3072:wdXm0UsJuZIXcj5WZWFFK6J15Bhcr+asB28MlqCqoZRTF2Mq9N5:wBmyuhfrXD6+9ghf2N
TLSH
T13724F151F7C0A9FBD025A03540BB56F34369E63750269FCEBBE35B5849CA1C0AA3871B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-2-0x0000000000447000-0x0000000000449000-memory.dmp

Download

memory/1888-11-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/1888-17-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2936-16-0x000000001005B000-0x000000001005D000-memory.dmp

Download

memory/2936-19-0x000000001005B000-0x000000001005D000-memory.dmp

Download