Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 03:11
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 670KB
- Sample261014-dpklcaec46
- SHA256 d84170b43e508aedf10bb5c50e71e84bbd54f75b3f1924d67f2a87e2bfc976b9
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe-z yon.dll3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tpmhh.rxo
memory/516-54-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-41-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-58-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-43-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-70-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-44-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-45-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-50-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/516-52-0x0000022B007F0000-0x0000022B0088E000-memory.dmp
memory/616-37-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/616-42-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/616-38-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/616-169-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/616-35-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/616-66-0x00000190A8D90000-0x00000190A8E2E000-memory.dmp
memory/684-114-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-85-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-115-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-55-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-79-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-110-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-187-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-117-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/684-116-0x0000026CFB7A0000-0x0000026CFB83E000-memory.dmp
memory/2360-29-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-33-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-36-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-32-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-31-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-21-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-20-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2360-166-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/2692-47-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-60-0x00000142794A0000-0x000001427953E000-memory.dmp
memory/2692-103-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-102-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-105-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-106-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-104-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-86-0x00000142794A0000-0x000001427953E000-memory.dmp
memory/2692-83-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-75-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2692-185-0x0000014279400000-0x000001427949E000-memory.dmp
memory/2896-107-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-111-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-113-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-65-0x000001CC42740000-0x000001CC427DE000-memory.dmp
memory/2896-109-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-49-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-87-0x000001CC42740000-0x000001CC427DE000-memory.dmp
memory/2896-77-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-108-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-84-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-186-0x000001CC420F0000-0x000001CC4218E000-memory.dmp
memory/2896-98-0x000001CC42740000-0x000001CC427DE000-memory.dmp
memory/3300-71-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-206-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-265-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-258-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-259-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-260-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-256-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-257-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-249-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-250-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-247-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-246-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-245-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-241-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-239-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-237-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-73-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-225-0x0000000002770000-0x0000000002780000-memory.dmp
memory/3300-224-0x0000000002750000-0x0000000002760000-memory.dmp
memory/3300-68-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-67-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-222-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-63-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-62-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-223-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-57-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-217-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-216-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-210-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-208-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-207-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-202-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-200-0x00007FF8BD6D0000-0x00007FF8BD7D7000-memory.dmp
memory/3300-199-0x00007FF8BD772000-0x00007FF8BD773000-memory.dmp
memory/3300-196-0x0000000002750000-0x0000000002760000-memory.dmp
memory/3300-72-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-69-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3300-197-0x0000000002770000-0x0000000002780000-memory.dmp
memory/3300-172-0x0000000004940000-0x00000000049DE000-memory.dmp
memory/3416-189-0x0000022F34200000-0x0000022F3429E000-memory.dmp
memory/3416-134-0x0000022F34200000-0x0000022F3429E000-memory.dmp
memory/3416-126-0x0000022F34200000-0x0000022F3429E000-memory.dmp
memory/3416-119-0x0000022F34200000-0x0000022F3429E000-memory.dmp
memory/3432-101-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-19-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-15-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-26-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-25-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-24-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-16-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-17-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-92-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-28-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-18-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-91-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-99-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-10-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-2-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-1-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-13-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-90-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-89-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-88-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-94-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-95-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-27-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-112-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-14-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-96-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-22-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-93-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-97-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-12-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-11-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3432-100-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-82-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3432-0-0x0000000000650000-0x0000000000651000-memory.dmp
memory/3432-3-0x00000000023A0000-0x000000000243E000-memory.dmp
memory/3604-121-0x0000022C929D0000-0x0000022C92A6E000-memory.dmp
memory/3604-135-0x0000022C929D0000-0x0000022C92A6E000-memory.dmp
memory/3604-190-0x0000022C929D0000-0x0000022C92A6E000-memory.dmp
memory/3604-130-0x0000022C929D0000-0x0000022C92A6E000-memory.dmp
memory/3752-191-0x000001E116F10000-0x000001E116FAE000-memory.dmp
memory/3752-123-0x000001E116F10000-0x000001E116FAE000-memory.dmp
memory/3752-132-0x000001E116F10000-0x000001E116FAE000-memory.dmp
memory/3752-138-0x000001E116F10000-0x000001E116FAE000-memory.dmp
memory/4040-136-0x000001EBBBBC0000-0x000001EBBBC5E000-memory.dmp
memory/4040-125-0x000001EBBBBC0000-0x000001EBBBC5E000-memory.dmp
memory/4040-140-0x000001EBBBBC0000-0x000001EBBBC5E000-memory.dmp
memory/4040-192-0x000001EBBBBC0000-0x000001EBBBC5E000-memory.dmp
memory/4120-194-0x000001BECDE00000-0x000001BECDE9E000-memory.dmp
memory/4120-232-0x000001BECDE00000-0x000001BECDE9E000-memory.dmp
memory/4120-168-0x000001BECDE00000-0x000001BECDE9E000-memory.dmp
memory/4456-193-0x0000021B61B60000-0x0000021B61BFE000-memory.dmp
memory/4456-167-0x0000021B61B60000-0x0000021B61BFE000-memory.dmp