2f480d3b9c98eee8b4ab59415197bc2765d35b51988260f58568c8c6a87960a8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 124KB
Sample261014-dbne3sft4k
SHA256 2f480d3b9c98eee8b4ab59415197bc2765d35b51988260f58568c8c6a87960a8
MD5 dd9ff2320834c14a806cc4e12fd98b75
SHA1 606106de57ae30ba57fb9e39a1a9116092eb62f2
SHA512 69c2f9a0adfc6c4080ffa869d39728105df77f1a2443329bde74454bddacba4bd07ac0264dc5186f3cd592e305b649f0c7720ca4a2fc31ea5d0df0e636252ae7
SSDEEP 3072:MdmuDcNZFruR8Kbq1qulNCDAmkPop1DwaL+p+C:gaidbgjvmkPop1DwaL+p+C
TLSH
T175C3025C16DC78DAC660DF3E104A435DAE3D359A4543C3E63C44F9CEAB09A02E6A1DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\eGLkzCfRN.com	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\win32dc\Counter-Strike_crack.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\DAoC trainer.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\Counter-Strike_crack.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 hack.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Doom 3(serial).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\DAoC(trainer).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Half-Life 2(patch).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\Half-Life 2(patch).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\BattleField 1942(patch).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Quake3 codes.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Silent Hill 4 hack.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\DAoC(trainer).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\DAoC trainer.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\BattleField 1942(patch).exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Counter-Strike + serial.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	C:\Windows\win32dc\Silent Hill 4 + codes.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\win32dc\Silent Hill 4 + codes.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DAoC trainer.exe

Path C:\Windows\win32dc\DAoC trainer.exe
Size 127KB
SHA256 7ec9269e03c42ed4779794bb6289be818abbc55cf1b8cc462dea3ce922f25f9e
MD5 afcc29bd75c07fa5d626ba84de1fc2bc
SHA1 7474778e03336c626b9abf9958107c53dd39cb69
SHA512 a136043b8cc94a610018ad62ef64746ab0fa8536ea71d83afde5e8ef8f642629f836bfc6046388ddebd4d6665614235b5b219e3ee801e9383dd7b19643423b2e
SSDEEP 3072:MdmuDcNZFruR8Kbq1qulNCDAmkPop1DwaL+p+FF:gaidbgjvmkPop1DwaL+p+7
TLSH
T150D3125C16CC78DAC220EF3E144A435DAE7D39994543C3E63C05F9CEAB09A02E2A5DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3400-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3400-9-0x0000000000400000-0x0000000000414000-memory.dmp