Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 1.5MB
- Sample261014-dvnvysec64
- SHA256 435404f574fbf89a903936999e95384025c500bb518a85e23b178199d518d25c
- MD5 929e48e032b5a53f7f9abf244f961299
- SHA1 45f5d3f0ac6420b83a9f4f11b64cde1f5f554fb4
- SHA512 06f9ff05bc4cfd09428632b6b92baf9a6f5bdea3a2e3a6cf7d58081af541a45e8d2b976a91efb909d33f4a1ea41e3ad978d0f26b5af22d0ace20fc8dac410bcd
- SSDEEP 24576:AKN3qU44VnMqFMygvWgQBQSRWxq0VJHTo6FaTLbI2ZqaIvuVnX:A06Mw6ySYqQk6FaTXIGq96
- TLSH T1A5755C22A3C45036E07E0B3A4C7AD7547D3B7B317E55885BAFFC8A4C0E3AB416C25696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\explorer.exe jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 5364 Process not Found 6076 Process not Found 708 Process not Found 2036 Process not Found 4556 Process not Found 6000 Process not Found 2940 Process not Found 4600 Process not Found 1436 Process not Found 1356 Process not Found 3612 Process not Found 2220 Process not Found 2540 Process not Found 5524 Process not Found 2464 Process not Found 1880 Process not Found 1540 Process not Found 1152 Process not Found 4944 Process not Found 5964 Process not Found 5852 Process not Found 4908 Process not Found 1244 Process not Found 5652 Process not Found 2320 Process not Found 3456 Process not Found 5844 Process not Found 4308 Process not Found 4688 Process not Found 4236 Process not Found 4868 Process not Found 5048 Process not Found 1208 Process not Found 2784 Process not Found 4540 Process not Found 5436 Process not Found 3724 Process not Found 4348 Process not Found 3184 Process not Found 4156 Process not Found 2024 Process not Found 2028 Process not Found 1416 Process not Found 4632 Process not Found 4856 Process not Found 5724 Process not Found 6024 Process not Found 2452 Process not Found 1576 Process not Found 4924 Process not Found 2360 Process not Found 2584 Process not Found 4464 Process not Found 5548 Process not Found 2428 Process not Found 5916 Process not Found 4564 Process not Found 4352 Process not Found 1200 Process not Found 5496 Process not Found 2924 Process not Found 3044 Process not Found 620 Process not Found 5504 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3476 wrote to memory of 5928 3476 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\windows\SysWOW64\explorer.exe"C:\windows\system32\explorer.exe"2⤵PID:5928
-
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000024C;0000000000000250;1⤵PID:4700
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3180
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1924
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2776
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3424
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4276
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4168
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4544