Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 02:48
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 172KB
- Sample261014-dat68sew9t
- SHA256 e781b6525400bf43836e50a6e597b6df7a6461ca63d889d08c251f1b2200acda
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Recycle.Bin\B6232F3AB2F.exe"C:\Recycle.Bin\B6232F3AB2F.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\h9FB973.exe"C:\Users\Admin\AppData\Local\Temp\h9FB973.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Recycle.Bin\B6232F3AB2F.exeC:\Recycle.Bin\B6232F3AB2F.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5D7BE35D0B2C77E
B6232F3AB2F.exe
h9FB973.exe
memory/1312-100-0x0000000000400000-0x0000000000476000-memory.dmp
memory/4172-75-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-77-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-4-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
memory/4172-3-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
memory/4172-65-0x0000000002000000-0x0000000002001000-memory.dmp
memory/4172-66-0x0000000077648000-0x000000007764A000-memory.dmp
memory/4172-16-0x000000000040B000-0x000000000040F000-memory.dmp
memory/4172-67-0x0000000002000000-0x0000000002001000-memory.dmp
memory/4172-2-0x0000000000400000-0x0000000000476000-memory.dmp
memory/4172-70-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-71-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-72-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-73-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-74-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-87-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-76-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-0-0x000000000040B000-0x000000000040F000-memory.dmp
memory/4172-6-0x0000000000400000-0x0000000000476000-memory.dmp
memory/4172-78-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-79-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-80-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-81-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-82-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-83-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-86-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-84-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-85-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-95-0x0000000076522000-0x0000000076524000-memory.dmp
memory/4172-94-0x000000007764A000-0x000000007764C000-memory.dmp
memory/4172-93-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-92-0x0000000077648000-0x000000007764A000-memory.dmp
memory/4172-90-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-89-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4172-1-0x0000000000400000-0x0000000000476000-memory.dmp
memory/4172-88-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-42-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-58-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-96-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-60-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-64-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-61-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-63-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-51-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-45-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-40-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-37-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-32-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-34-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-23-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-28-0x0000000001001000-0x0000000001002000-memory.dmp
memory/4700-29-0x0000000001000000-0x0000000001004000-memory.dmp
memory/4700-30-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-120-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-105-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-31-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/4700-59-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-98-0x00000000764F0000-0x00000000766A9000-memory.dmp
memory/4700-57-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-56-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-55-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-54-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-53-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-52-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-50-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-49-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-48-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-47-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-46-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-44-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-43-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-41-0x000000000BAD0000-0x000000000BB1E000-memory.dmp
memory/4700-36-0x0000000000570000-0x0000000000576000-memory.dmp
memory/4700-35-0x0000000000860000-0x00000000008AE000-memory.dmp
memory/5140-14-0x0000000000400000-0x0000000000476000-memory.dmp
memory/5140-13-0x0000000000400000-0x0000000000476000-memory.dmp
memory/5140-15-0x0000000000400000-0x0000000000476000-memory.dmp
memory/5140-21-0x0000000000400000-0x0000000000476000-memory.dmp