Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 01:57
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 196KB
- Sample261014-cdm2naty8p
- SHA256 dac78c880ee85205b860f005063bb8a8cc4371855ed4e45f7f47fda9e5bb7ae3
- MD5 3c519ff362cfc199096cfd85ca2a2a8a
- SHA1 952fd182de2b4e4a79c29228c7b441736e9afcda
- SHA512 6061697c0023f095d670cebe8991d32559113d6e321a6864ee53e6af56bd63be742ebf928a7f6db04575ae160142bbdee0499866a463e41743c38127a16a4d29
- SSDEEP 3072:46aAQw1H4kZdN9ffilSjRr3871TWpxdDmZxg0MtuZEQ+z:0AQw1YIX9fAStpbmfgfth
- TLSH T167146CADFF84CFE7CBBE03F8E8A2712447B9525B519AF74B044848E92A153C7C196193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini jaffacakes118_HEUR.Trojan.Win32.Generic.exe File opened for modification C:\Windows\assembly\Desktop.ini jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly jaffacakes118_HEUR.Trojan.Win32.Generic.exe File created C:\Windows\assembly\Desktop.ini jaffacakes118_HEUR.Trojan.Win32.Generic.exe File opened for modification C:\Windows\assembly\Desktop.ini jaffacakes118_HEUR.Trojan.Win32.Generic.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: 33 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeIncBasePriorityPrivilege 3320 jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3320