Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 03:11
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 670KB
- Sample261014-dpklcaec46
- SHA256 d84170b43e508aedf10bb5c50e71e84bbd54f75b3f1924d67f2a87e2bfc976b9
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000270;0000000000000274;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe-i jucj.dll4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
xwzzks.hkw
memory/744-38-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-154-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-63-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-34-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-35-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-36-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/744-37-0x00000185A50B0000-0x00000185A514E000-memory.dmp
memory/1240-48-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-56-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-55-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-42-0x0000024D26920000-0x0000024D269BE000-memory.dmp
memory/1240-40-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-51-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-52-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-65-0x0000024D26920000-0x0000024D269BE000-memory.dmp
memory/1240-54-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-58-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-47-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/1240-64-0x0000024D26830000-0x0000024D268CE000-memory.dmp
memory/2612-209-0x000001F306E80000-0x000001F306F1E000-memory.dmp
memory/2612-239-0x000001F306E80000-0x000001F306F1E000-memory.dmp
memory/2808-235-0x0000014282EF0000-0x0000014282F8E000-memory.dmp
memory/2808-155-0x0000014282EF0000-0x0000014282F8E000-memory.dmp
memory/2904-19-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-3-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-1-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-0-0x0000000002230000-0x0000000002231000-memory.dmp
memory/2904-13-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-16-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-15-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-14-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-30-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-12-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-11-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-21-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-29-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-31-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-32-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-10-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-22-0x0000000002320000-0x0000000002321000-memory.dmp
memory/2904-2-0x00000000023C0000-0x000000000245E000-memory.dmp
memory/2904-17-0x0000000002320000-0x0000000002321000-memory.dmp
memory/3032-238-0x0000000005F60000-0x0000000005FFE000-memory.dmp
memory/3032-208-0x0000000005F60000-0x0000000005FFE000-memory.dmp
memory/3140-70-0x000001E88DEF0000-0x000001E88DF8E000-memory.dmp
memory/3140-77-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-72-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-79-0x000001E88DEF0000-0x000001E88DF8E000-memory.dmp
memory/3140-44-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-60-0x000001E88DEF0000-0x000001E88DF8E000-memory.dmp
memory/3140-80-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-66-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-89-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-157-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-86-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-91-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3140-93-0x000001E88DE50000-0x000001E88DEEE000-memory.dmp
memory/3212-146-0x00000169DD950000-0x00000169DD9EE000-memory.dmp
memory/3212-233-0x00000169DD950000-0x00000169DD9EE000-memory.dmp
memory/3228-87-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-69-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-78-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-67-0x0000020201F40000-0x0000020201FDE000-memory.dmp
memory/3228-73-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-74-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-196-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-62-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-92-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-46-0x0000020201F40000-0x0000020201FDE000-memory.dmp
memory/3228-88-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-84-0x00000202048A0000-0x000002020493E000-memory.dmp
memory/3228-81-0x0000020201F40000-0x0000020201FDE000-memory.dmp
memory/3292-106-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3292-109-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3292-107-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3292-95-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3292-102-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3292-210-0x000001E50CFF0000-0x000001E50D08E000-memory.dmp
memory/3628-85-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-68-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-71-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-195-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-75-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-76-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-82-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-83-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-50-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/3628-90-0x0000016804D00000-0x0000016804D9E000-memory.dmp
memory/4368-212-0x00000241597B0000-0x000002415984E000-memory.dmp
memory/4368-108-0x00000241597B0000-0x000002415984E000-memory.dmp
memory/4368-97-0x00000241597B0000-0x000002415984E000-memory.dmp
memory/4368-103-0x00000241597B0000-0x000002415984E000-memory.dmp
memory/4412-215-0x000002F08E9E0000-0x000002F08EA7E000-memory.dmp
memory/4412-104-0x000002F08E9E0000-0x000002F08EA7E000-memory.dmp
memory/4412-99-0x000002F08E9E0000-0x000002F08EA7E000-memory.dmp
memory/4460-101-0x0000021B9F5A0000-0x0000021B9F63E000-memory.dmp
memory/4460-105-0x0000021B9F5A0000-0x0000021B9F63E000-memory.dmp
memory/4460-216-0x0000021B9F5A0000-0x0000021B9F63E000-memory.dmp
memory/4612-28-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-26-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-25-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-18-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-151-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-23-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-27-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-20-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4612-24-0x0000000000980000-0x0000000000A1E000-memory.dmp
memory/4716-234-0x000002C612730000-0x000002C6127CE000-memory.dmp
memory/4716-148-0x000002C612730000-0x000002C6127CE000-memory.dmp
memory/5156-236-0x00000223B7D80000-0x00000223B7E1E000-memory.dmp
memory/5156-156-0x00000223B7D80000-0x00000223B7E1E000-memory.dmp
memory/5192-207-0x0000013146820000-0x00000131468BE000-memory.dmp
memory/5192-237-0x0000013146820000-0x00000131468BE000-memory.dmp