16726a5322f5b86db8fe6c0a5d510b20db3deae2009e7374bba6854133174b55

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 977KB
Sample261014-hg28msg171
SHA256 16726a5322f5b86db8fe6c0a5d510b20db3deae2009e7374bba6854133174b55
MD5 3f2045fc999cf3274cda1587a4a96bf0
SHA1 7956255cec6072a4faaa06e7853bb810335d74e3
SHA512 ecb1feeb839aa393088386dc965eeb6566fde7121307c09192f15c6b703b4fcb6e81c7cca4ddd62d12817773b835b8c33c86e72245aa44c15e33b928a3211977
SSDEEP 24576:z1dlZo5u3kGOqy2zuL9a6Wz6ZgRJWkiERxU9TUQ0:z1dlZoekWUL9fW2uVU9TUQ0
TLSH
T13B2523A4C0D214BAD82AA4795F61CB343F749F161A1EC90293E9FD5F8C7EA57B709308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\KeDetective131.sys	Kernel Detective.exe

Executes dropped EXE 3 IoCs

pid	Process
988	server1.exe
1896	server1.exe
4248	Kernel Detective.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000001c4bf-19.dat	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 1896	988	server1.exe	89

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1896-25-0x0000000000400000-0x0000000000457000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	4248	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kernel Detective.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	Kernel Detective.exe
Token: SeLoadDriverPrivilege	4248	Kernel Detective.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 988	124	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	88
PID 988 wrote to memory of 1896	988	server1.exe	89
PID 988 wrote to memory of 1896	988	server1.exe	89
PID 988 wrote to memory of 1896	988	server1.exe	89
PID 988 wrote to memory of 1896	988	server1.exe	89
PID 124 wrote to memory of 4248	124	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:124
- C:\Extracted\server1.exe
  "C:\Extracted\server1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Extracted\server1.exe
    "C:\Extracted\server1.exe"
    3⤵
    - Executes dropped EXE
    PID:1896
- C:\Extracted\Kernel Detective.exe
  "C:\Extracted\Kernel Detective.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 832
    3⤵
    - Program crash
    PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4248 -ip 4248
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kernel Detective.exe

Path C:\Extracted\Kernel Detective.exe
Size 253KB
SHA256 b98d6fad7ff58cbd4e5e7b4c68f9868525e2c7779bf0aa8a7de0864b72e610bc
MD5 32e6f0240604951df67fd058c41a8d9d
SHA1 1ee0bdd45d4ef846b7c8ac429a11c32db817d13e
SHA512 c828d9e53a684443fbf5712504b27cfdfba3daadec09df60af754d070585ddeb96960be4731f375d8ce938d9af95e11dd0df975bb2bbdd004ab75beef0c0f11c
SSDEEP 6144:Sayuzzy6EFpyG/mY4GTIEHP3mEYUZKHqyVKbLoSQ:LzzZE2Y46/m1UQHqygXoSQ
TLSH
T16A441285C1564B24DADE30B54FA6EA102714DEAB5A8D8F3356F47C1FBC6DE0BAB10214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

server1.exe

Path C:\Extracted\server1.exe
Size 942KB
SHA256 c4dad12bbfa20e8aea82f329ee57c5db3b9d0ecbbbf6182103e661854478ce8a
MD5 be3dff6523f1411b43416534d03d86a7
SHA1 6084e649cfa4c6df629da812cb37ce3ec7676335
SHA512 aa94cfdd82a02dac473cc0a6f2aa6e195b6a213ae02b0b9552cef37eb37d0fa33b95c3cded5ef3a4c257b7a16393816f8761fb119e73f36c1b4b26fb445df7b4
SSDEEP 24576:DaHMv6Corjqny/QtqDZRJQkUwRRURTQMQ:D1vqjd/Qtq19URTQMQ
TLSH
T11E25BF12B3D680B6D99339F02937E326AB357D194326C487A7F03E668E31153DE2636D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.ini

Path C:\Users\Admin\AppData\Local\Temp\sfx.ini
Size 206B
SHA256 cc12652dac484035a05ed6aa038c91d7d8105cedc45d9b7d5f69cb438d42e306
MD5 b81c8fbc4a61f82c774f644628dafefe
SHA1 0c8590efade308e8e61f4cb6da2bbeccf1d35860
SHA512 f3cf39877aae369bf4a21640b5b59edfe6f8c190bf109b894736a151e4550e3bc99bb4640b5bbb7f7716de1964c52acbef6bb6895165d1cd207c15b9c0ea2741
TLSH
T1E2D0229DD1DEA0102BEA44A00B693000209B5A65EC002212EB2520CE3CA2A50C52E35F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-25-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4248-34-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4248-37-0x0000000000400000-0x000000000047E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads