Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 1.5MB
- Sample261014-hq9dbafa64
- SHA256 9897ad0f5b1c2443ebe791928233bc4c14dbba65d8d597f0ce093ba61f26a39a
- MD5 bf14c2c76e964e3a589bfa196f189408
- SHA1 f98719daee6c68efe3fe69269be117cedbaa099c
- SHA512 ebe21148f5b03227fe7048173e5299158fe4657718455b32f0931d41a2c5c1d4e012eabdf307d9ae0fbf039cd417b7db49c02fc8f195dae3d9cc04d155df0286
- SSDEEP 24576:EKN3qU44VnMqFMygvWgQBQSRWxq0VJHTo6FaTLbI2ZqaIvuVnXC:E06Mw6ySYqQk6FaTXIGq96S
- TLSH T13D755C22A3C45036E07E0B3A4C7AD7547D3B7B317E55885BAFFC8A4C0E3AB416C25696
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\explorer.exe jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe - Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4220 Process not Found 5912 Process not Found 5160 Process not Found 4124 Process not Found 4488 Process not Found 4608 Process not Found 4232 Process not Found 940 Process not Found 2724 Process not Found 1216 Process not Found 2832 Process not Found 2680 Process not Found 1348 Process not Found 2740 Process not Found 3028 Process not Found 244 Process not Found 2340 Process not Found 1256 Process not Found 796 Process not Found 4636 Process not Found 2536 Process not Found 3472 Process not Found 4276 Process not Found 464 Process not Found 4320 Process not Found 4956 Process not Found 3076 Process not Found 3880 Process not Found 1172 Process not Found 2708 Process not Found 5260 Process not Found 5248 Process not Found 4024 Process not Found 2336 Process not Found 5580 Process not Found 4484 Process not Found 5764 Process not Found 5936 Process not Found 5972 Process not Found 4652 Process not Found 4648 Process not Found 3832 Process not Found 1116 Process not Found 500 Process not Found 2620 Process not Found 2916 Process not Found 1036 Process not Found 5960 Process not Found 4948 Process not Found 3164 Process not Found 4020 Process not Found 1760 Process not Found 2800 Process not Found 5700 Process not Found 3380 Process not Found 1784 Process not Found 3320 Process not Found 1200 Process not Found 4092 Process not Found 1832 Process not Found 2612 Process not Found 6004 Process not Found 4708 Process not Found 3140 Process not Found - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4076 wrote to memory of 4840 4076 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\windows\SysWOW64\explorer.exe"C:\windows\system32\explorer.exe"2⤵PID:4840
-
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4476
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4680
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:6116
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4868
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4104
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:824
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4172
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:4016