3693e8a934622643ca5a05b3519884e68b956b6883b86e860c3503b4b81cc2e2

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:08

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 331KB
Sample261014-dnbxtavv4m
SHA256 3693e8a934622643ca5a05b3519884e68b956b6883b86e860c3503b4b81cc2e2
MD5 4ec15e843abf4fa409b0cee9e77cbeba
SHA1 e21802561b112722a267c3fdeb8bbec6f2d4d903
SHA512 2842857bd64ce126f2b83b8b02216bbe9f9ba71cca438a42e55156509c8223e9b0a3f238f2a86bf677402f9034eee524ec8f91915e25086017c496477ef165e7
SSDEEP 6144:tziZsrdFoVsLbcsoCwGwKDF9YXzukoKeaOKZ8SoRJ2pIKrnewKkTa2Dd/5I7:tKsrPx4Ew+zAMxJETa2BK7
TLSH
T15574F1DAF6DC2443F4D56E390980BE37A757EC76362BB4D655F3024BDA2C080DD16922
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Yzutuwocucaf = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_HEUR.Trojan.Win32.Generic.dll\",Startup"	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	rundll32.exe
5656	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5656	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 5656	2808	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5656