5d85bc45fa854bd127878d782749d530b4da6eea0178c227d1803341acebd77e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:47

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 121KB
Sample261014-c93f8aft2j
SHA256 5d85bc45fa854bd127878d782749d530b4da6eea0178c227d1803341acebd77e
MD5 4b47dcfe066ca033027efa63cb1947c3
SHA1 2f777c7690fdadd95e138789bf36c284b198d4d3
SHA512 4c0eaf6374b31e079ef50b24927febb4ee350ffbf6be797b0e559d393204859712dd87482ebf2140cc97eb823c3ced502a15d3d2aae57ad51187ba45ed9626bf
SSDEEP 3072:E6H3M55XHx8wXdmtbKzAaT7H0VOkR60vHwAAxNf+:BH85xxLIQrT7Uto0vwAef
TLSH
T1D3C31224C7BCC66AF0B26E38153B72480A65BDB3FD369F0A109D590C9D253229C59FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

Registry Run Keys / Startup Folder

Modify Registry

Windows Service

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7e377870\imagepath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\B84A.tmp"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	4584	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
4584	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4584	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4584	2176	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - Sets service image path in registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 668
    3⤵
    - Program crash
    PID:1912