c6f0a0c8ad9b482d7912e502753ced7199964306d704644eaee2b27a5db478fa

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 45KB
Sample261014-ddntmaxwev
SHA256 c6f0a0c8ad9b482d7912e502753ced7199964306d704644eaee2b27a5db478fa
MD5 4ca261517901379d86176c2b78412aee
SHA1 1dfb0ef1cfa29bb8fe9fb58f31545ecf3bd7ba2f
SHA512 eeedaf389484f9299ffc6897fbb5fce1c7d1fb52a3adeea49d2ccd168964dc78ced8f6f9ff72eb9a82272afb54ed397a062347785745e684ed2a391f4636727a
SSDEEP 768:20xgq1jyo9fbf6I8cuotTKUHxMuexZh6q6nnu+7Wi:26bG+OIOTUHxUbJ+yi
TLSH
T17B23F80BEA508034E0D10075D2125FB79AF968B37359C7A3E3E599A678383E4EE3951F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2704	winsvc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-5050506265024805240640200\\winsvc.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-5050506265024805240640200\\winsvc.exe"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\M-5050506265024805240640200\winsvc.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\M-5050506265024805240640200	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\M-5050506265024805240640200\winsvc.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	winsvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	winsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2704	2880	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\M-5050506265024805240640200\winsvc.exe
  C:\Windows\M-5050506265024805240640200\winsvc.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winsvc.exe

Path C:\Windows\M-5050506265024805240640200\winsvc.exe
Size 45KB
SHA256 c6f0a0c8ad9b482d7912e502753ced7199964306d704644eaee2b27a5db478fa
MD5 4ca261517901379d86176c2b78412aee
SHA1 1dfb0ef1cfa29bb8fe9fb58f31545ecf3bd7ba2f
SHA512 eeedaf389484f9299ffc6897fbb5fce1c7d1fb52a3adeea49d2ccd168964dc78ced8f6f9ff72eb9a82272afb54ed397a062347785745e684ed2a391f4636727a
SSDEEP 768:20xgq1jyo9fbf6I8cuotTKUHxMuexZh6q6nnu+7Wi:26bG+OIOTUHxUbJ+yi
TLSH
T17B23F80BEA508034E0D10075D2125FB79AF968B37359C7A3E3E599A678383E4EE3951F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads