Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 02:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 116KB
- Sample261014-cpgzsaeb48
- SHA256 24c674bf8e213f1e6f4b63af39af42ed7ca8b18bbfc42a920a568415d938bdd7
- MD5 3f7f8776f9d11b319b55cd451e722163
- SHA1 e180c48004de259f44868b2dfcbc6de1584d4961
- SHA512 a3dc8262a865433bf1e72688879594f3d0952fa6a3b7a89a98f95ebd6c08139563bffb2774f80e28bb434a915473193c6b142bbeb145e110ff873b7c772bdc50
- SSDEEP 1536:GUSuY/3tivRT6WwbCPdHA1/VEWbAcWWz2lvjp40UQ5CnybraRHd3U4JNkexUx+cv:GUMftORT2b6HAnEW0cWakb+2NHCtrcv
- TLSH T1C6C3DF1DBC935687F48A8C71E7E268CA4FBE4D6374E3257FCF90145A099029DA886DF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3244 set thread context of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89 PID 3244 wrote to memory of 5384 3244 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe2⤵PID:5384
-