Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 02:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.dll
- Size 584KB
- Sample261014-ct9wcsxtc1
- SHA256 b683621e2f8a7394d532f03b0f7b7376efcd3bf1b4465059c2a467c44d59bf64
- MD5 42bd8bb030bb4228f38c00d2de09446b
- SHA1 94e33d5c86d0c0a0f1e3db3faadfe7652e600593
- SHA512 d4223f5b60ad6ad33e9d91b752ec7ae3d1dfbec10f9168bdd543155eac490ed7fed12a2e215a0c3053ecaabead3a8aa3657ea9f51d414fc39c0d6626d58cd63d
- SSDEEP 12288:auJ6AiMoRNR2mLg5v4LJtQouZ8K+XBiuwH/7u1Vp6adjUYM/WpOUI:EN2QLHLuZ+Rl4/CbpfdjJcZ
- TLSH T1A6D42363614CD95CE4D25279F56E1EAF50830C0FB1AA4BEB033668ACD4EDF75A60B2C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" regsvr32.exe - Stops running service(s) 4 TTPs
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9A0EB49D-16CA-4BE3-852C-B7A84E059167} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\ = "Adobe Flash Player Helper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} regsvr32.exe - Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4080 SC.exe 3180 SC.exe 124 SC.exe 3260 SC.exe 1704 SC.exe 5028 SC.exe 260 SC.exe 252 SC.exe 4668 SC.exe 4708 SC.exe 4540 SC.exe - System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SC.exe - Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_HEUR.Trojan.Win32.Generic.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\ = "Adobe Flash Player Helper" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9A0EB49D-16CA-4BE3-852C-B7A84E059167}\ regsvr32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe 4640 regsvr32.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3656 wrote to memory of 4640 3656 regsvr32.exe 87 PID 4640 wrote to memory of 3180 4640 regsvr32.exe 89 PID 4640 wrote to memory of 3260 4640 regsvr32.exe 90 PID 4640 wrote to memory of 4080 4640 regsvr32.exe 91 PID 4640 wrote to memory of 4540 4640 regsvr32.exe 92 PID 4640 wrote to memory of 4708 4640 regsvr32.exe 93 PID 4640 wrote to memory of 4668 4640 regsvr32.exe 94 PID 4640 wrote to memory of 252 4640 regsvr32.exe 95 PID 4640 wrote to memory of 124 4640 regsvr32.exe 96 PID 4640 wrote to memory of 260 4640 regsvr32.exe 97 PID 4640 wrote to memory of 5028 4640 regsvr32.exe 98 PID 4640 wrote to memory of 1704 4640 regsvr32.exe 99
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll2⤵
- UAC bypass
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\SC.exeSC stop AVGIDSAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3180
-
-
C:\Windows\SysWOW64\SC.exeSC stop AVGIDSAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3260
-
-
C:\Windows\SysWOW64\SC.exeSC stop avg9wd3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4080
-
-
C:\Windows\SysWOW64\SC.exeSC stop AVGWD3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4540
-
-
C:\Windows\SysWOW64\SC.exeSC stop AVGIDSAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4708
-
-
C:\Windows\SysWOW64\SC.exeSC DELETE AVGIDSAgent3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4668
-
-
C:\Windows\SysWOW64\SC.exeSC DELETE avg9wd3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:252
-
-
C:\Windows\SysWOW64\SC.exeSC DELETE AVGWD3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:124
-
-
C:\Windows\SysWOW64\SC.exeSC STOP "avast! Web Scanner"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:260
-
-
C:\Windows\SysWOW64\SC.exeSC STOP "avast! Mail Scanner"3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5028
-
-
C:\Windows\SysWOW64\SC.exeSC STOP "aswUpdSv3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1704
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Browser Extensions
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1