Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 07:00
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 646KB
- Sample261014-hszlwsfa68
- SHA256 0ec0bd5e1fa273ffa462be2ef98ab231113689095a231697ad3a214597f86655
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000270;0000000000000274;1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe-wo awltlo.dll4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
oua.aax
memory/496-27-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-28-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-174-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-29-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-26-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-15-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-33-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-14-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/496-25-0x0000000000020000-0x00000000000BE000-memory.dmp
memory/744-38-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-40-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-39-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-44-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-35-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-63-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/744-178-0x00000206228E0000-0x000002062297E000-memory.dmp
memory/1188-50-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-37-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-48-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-43-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-42-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-46-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-41-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-64-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-47-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/1188-45-0x000002E2DDCB0000-0x000002E2DDD4E000-memory.dmp
memory/2820-177-0x0000017FCBA30000-0x0000017FCBACE000-memory.dmp
memory/2820-234-0x0000017FCBA30000-0x0000017FCBACE000-memory.dmp
memory/3140-80-0x0000025479970000-0x0000025479A0E000-memory.dmp
memory/3140-69-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-213-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-51-0x0000025479970000-0x0000025479A0E000-memory.dmp
memory/3140-59-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-97-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-65-0x0000025479970000-0x0000025479A0E000-memory.dmp
memory/3140-76-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-77-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-83-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-85-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-87-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3140-88-0x0000025479A10000-0x0000025479AAE000-memory.dmp
memory/3236-62-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-66-0x00000193B3560000-0x00000193B35FE000-memory.dmp
memory/3236-79-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-90-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-214-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-98-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-91-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-89-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-78-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-70-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3236-53-0x00000193B3560000-0x00000193B35FE000-memory.dmp
memory/3236-71-0x00000193B3560000-0x00000193B35FE000-memory.dmp
memory/3236-84-0x00000193B3600000-0x00000193B369E000-memory.dmp
memory/3352-236-0x000002029CEE0000-0x000002029CF7E000-memory.dmp
memory/3352-217-0x000002029CEE0000-0x000002029CF7E000-memory.dmp
memory/3472-73-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-86-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-92-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-81-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-55-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-93-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-72-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-99-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-208-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3472-67-0x0000019EC7D30000-0x0000019EC7DCE000-memory.dmp
memory/3560-210-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-96-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-95-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-94-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-82-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-75-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-57-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-100-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-74-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/3560-68-0x000001FA262D0000-0x000001FA2636E000-memory.dmp
memory/4352-110-0x000001958AAA0000-0x000001958AB3E000-memory.dmp
memory/4352-226-0x000001958AAA0000-0x000001958AB3E000-memory.dmp
memory/4352-102-0x000001958AAA0000-0x000001958AB3E000-memory.dmp
memory/4420-104-0x0000029190440000-0x00000291904DE000-memory.dmp
memory/4420-111-0x0000029190440000-0x00000291904DE000-memory.dmp
memory/4420-227-0x0000029190440000-0x00000291904DE000-memory.dmp
memory/4476-112-0x000001A3B0600000-0x000001A3B069E000-memory.dmp
memory/4476-228-0x000001A3B0600000-0x000001A3B069E000-memory.dmp
memory/4728-113-0x000001CFEA390000-0x000001CFEA42E000-memory.dmp
memory/4728-229-0x000001CFEA390000-0x000001CFEA42E000-memory.dmp
memory/5008-231-0x000001DA92980000-0x000001DA92A1E000-memory.dmp
memory/5008-168-0x000001DA92980000-0x000001DA92A1E000-memory.dmp
memory/5128-232-0x000001293D790000-0x000001293D82E000-memory.dmp
memory/5128-175-0x000001293D790000-0x000001293D82E000-memory.dmp
memory/5236-176-0x000001E44F3A0000-0x000001E44F43E000-memory.dmp
memory/5236-233-0x000001E44F3A0000-0x000001E44F43E000-memory.dmp
memory/5976-19-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-22-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-11-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-2-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-3-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-18-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-20-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-16-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-13-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-32-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-60-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-30-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-0-0x0000000002230000-0x0000000002231000-memory.dmp
memory/5976-12-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-23-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-24-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-10-0x0000000002780000-0x000000000281E000-memory.dmp
memory/5976-21-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5976-1-0x0000000002780000-0x000000000281E000-memory.dmp
memory/6000-235-0x0000000003520000-0x00000000035BE000-memory.dmp
memory/6000-216-0x0000000003520000-0x00000000035BE000-memory.dmp