30371ef430f71f5f90f69c38e27ff9bce6a93ddc562d41e40c7732729c2f5f3f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 68KB
Sample261014-dn17psey5s
SHA256 30371ef430f71f5f90f69c38e27ff9bce6a93ddc562d41e40c7732729c2f5f3f
MD5 4f272c31c3bff9f975ecce3260ccdbde
SHA1 018d0e33d5bc12e2a2643935db51a9a67cfde1b1
SHA512 66d3f957fdfad7ef30f4b8815478483d6e71fefc0fe0f0541b5b30f9abbbd6e286118746bdb5ddc25d333538ed3565444f3e3ccb1881cf45efa54c65e3b9f2b4
SSDEEP 768:MRgrxJRhYBuxMTLEQCvqp8vDZSSG+xg3xi+wo0nzlO9katnhyAJrA4XCSI4vTjb:M2rxJ8XE/vqir60Bzqnhyz4Sun
TLSH
T182639D139B339B0BD0033EFC33C5A7D5AEA97AB6500092DFB990774D46269B0D4E96E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4800	F5C0360D.EXE
3052	F5C0360D.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\F5C0360D = "C:\\Users\\Admin\\AppData\\Roaming\\F5C0360D\\F5C0360D.EXE"	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F5C0360D.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4800	F5C0360D.EXE
4800	F5C0360D.EXE
3052	F5C0360D.EXE
3052	F5C0360D.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5464	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeDebugPrivilege	4800	F5C0360D.EXE
Token: SeDebugPrivilege	3052	F5C0360D.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5464 wrote to memory of 4800	5464	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	91
PID 5464 wrote to memory of 4344	5464	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	92
PID 4800 wrote to memory of 4884	4800	F5C0360D.EXE	81
PID 4800 wrote to memory of 4884	4800	F5C0360D.EXE	81
PID 4800 wrote to memory of 4884	4800	F5C0360D.EXE	81
PID 4800 wrote to memory of 4884	4800	F5C0360D.EXE	81
PID 4800 wrote to memory of 4884	4800	F5C0360D.EXE	81
PID 3052 wrote to memory of 4884	3052	F5C0360D.EXE	81
PID 3052 wrote to memory of 4884	3052	F5C0360D.EXE	81
PID 3052 wrote to memory of 4884	3052	F5C0360D.EXE	81
PID 3052 wrote to memory of 4884	3052	F5C0360D.EXE	81
PID 3052 wrote to memory of 4884	3052	F5C0360D.EXE	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4884
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Users\Admin\AppData\Roaming\F5C0360D\F5C0360D.EXE
    "C:\Users\Admin\AppData\Roaming\F5C0360D\F5C0360D.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\POS3B69.tmp.BAT"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4344

C:\Users\Admin\AppData\Roaming\F5C0360D\F5C0360D.EXE
C:\Users\Admin\AppData\Roaming\F5C0360D\F5C0360D.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

POS3B69.tmp.BAT

Path C:\Users\Admin\AppData\Local\Temp\POS3B69.tmp.BAT
Size 272B
SHA256 1dbe6a2b1bf4072044e3f000bd8afda73e74d1217571eed7b5719258e318116d
MD5 6e41f5147842c8209fb43894fa083df7
SHA1 1ca1d529878bc414b3b5693006d0b3907c2e9ba9
SHA512 61dbd0df467d7e9a2927f3355256a4bebd92b9bf7df3b7f35d0a8e5e8bb1b4896e70de1725a5fa50b4e5c227e72d83ebac9053a7182aab4c34249c5c1efde0ca
TLSH
T1FAD0C20281878B280840CC2B61799A8DE1948D4C2BCD3F300322C28883A341ABAC6395
MD5 SHA1 SHA512 TLSH

Submit Download

F5C0360D.EXE

Path C:\Users\Admin\AppData\Roaming\F5C0360D\F5C0360D.EXE
Size 68KB
SHA256 30371ef430f71f5f90f69c38e27ff9bce6a93ddc562d41e40c7732729c2f5f3f
MD5 4f272c31c3bff9f975ecce3260ccdbde
SHA1 018d0e33d5bc12e2a2643935db51a9a67cfde1b1
SHA512 66d3f957fdfad7ef30f4b8815478483d6e71fefc0fe0f0541b5b30f9abbbd6e286118746bdb5ddc25d333538ed3565444f3e3ccb1881cf45efa54c65e3b9f2b4
SSDEEP 768:MRgrxJRhYBuxMTLEQCvqp8vDZSSG+xg3xi+wo0nzlO9katnhyAJrA4XCSI4vTjb:M2rxJ8XE/vqir60Bzqnhyz4Sun
TLSH
T182639D139B339B0BD0033EFC33C5A7D5AEA97AB6500092DFB990774D46269B0D4E96E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3052-17-0x0000000001F60000-0x0000000001F96000-memory.dmp

Download

memory/3052-23-0x0000000001F60000-0x0000000001F96000-memory.dmp

Download

memory/3052-22-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4800-11-0x0000000001F60000-0x0000000001F96000-memory.dmp

Download

memory/4800-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4884-12-0x0000000003280000-0x00000000032A1000-memory.dmp

Download

memory/4884-19-0x00000000034C0000-0x00000000034E1000-memory.dmp

Download

memory/5464-0-0x0000000001F50000-0x0000000001F86000-memory.dmp

Download

memory/5464-8-0x0000000001F50000-0x0000000001F86000-memory.dmp

Download

memory/5464-7-0x0000000000400000-0x0000000000436000-memory.dmp

Download