09615346610dba88f1b3b947668d71e6f521b7d5f036e800728388295638e98f

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 895KB
Sample261014-ds2n2axybv
SHA256 09615346610dba88f1b3b947668d71e6f521b7d5f036e800728388295638e98f
MD5 51d2cc6eebb2daa9072399d450695ca1
SHA1 ba8ed8883896ac9072fc2d6d8cfd3851e04197a8
SHA512 1010b3ca323f01a87de6db096ce2995f37f603c15bd2db4ac36ec7621586e84104a1038d8daa67b81b010ce21a54ad37dbc793ab22d08491df82828d3bbfa81f
SSDEEP 24576:XwQpBaWnBCqGvfGkPQTymLUwK/JbN20N1bQ:XlpBaWntGvekPQumLaBbLN10
TLSH
T1D41523500B7B6911D128B071147707728AB8FD9BC528EA1F89BB78313CA95EE379F847
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4892	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\EtNDuISBB.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File opened for modification	C:\Windows\SysWOW64\EtNDuISBB.dll	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4892	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4892	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EtNDuISBB.dll

Path C:\Windows\SysWOW64\EtNDuISBB.dll
Size 1.4MB
SHA256 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
MD5 25f62c02619174b35851b0e0455b3d94
SHA1 4e8ee85157f1769f6e3f61c0acbe59072209da71
SHA512 f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a
SSDEEP 24576:/NqrWz23mmOittiMQVZb2NOTGTZg2REA7qc+vM597KXNWU8fSV2z3PNGvCQSIjuT:/NQimtzbQVB2PpEVa2XNWUISV20AIq
TLSH
T102659E1337D08162D7A3653449176379B7BC6D119836ED4BAFA0394F2D33B01A72BB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4892-0-0x0000000000400000-0x00000000007A7000-memory.dmp

Download

memory/4892-10-0x0000000000400000-0x00000000007A7000-memory.dmp