Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 08:21
Behavioral task
behavioral1
Sample
jaffacakes118_Packed.Win32.Klone.af.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Packed.Win32.Klone.af.exe
- Size 38KB
- Sample261014-j9cdcsav9m
- SHA256 39a29a584953e31061e87ebca8785d6dee0753ee0bd62cd9dd64bbe8e6827d27
- MD5 7d12f562ea7756664af616bb2f9516e1
- SHA1 1cd7466a6fdbf04c72f201cb369252d469997ece
- SHA512 f55e797a7ec55a0c1473b7c01915179a9fbf518aa737d3e7c5214957bec332ac4d941a043954a6922c9693e9b185e26d9b66d0ba8854c8ebd55cb7ec6b11f1e8
- SSDEEP 768:qOQnxjb3emTOlInafvBBtoS6s6DyjzGZ+hhCf9NOrfe:qOAx/O+G5iDs3GZjNIfe
- TLSH T1DC03DF3A26FA66E8D14C43B15D2ED36F116FA2D20C6DFFF22B0515DFA00239910A177A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\zfhcnfbr.sys jaffacakes118_Packed.Win32.Klone.af.exe - Loads dropped DLL 1 IoCs
pid Process 3412 jaffacakes118_Packed.Win32.Klone.af.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\zfhcnfbr.dll jaffacakes118_Packed.Win32.Klone.af.exe File created C:\Windows\SysWOW64\zfhcnfbr.drv jaffacakes118_Packed.Win32.Klone.af.exe File opened for modification C:\Windows\SysWOW64\zfhcnfbr.dll jaffacakes118_Packed.Win32.Klone.af.exe -
resource yara_rule behavioral2/memory/3412-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/3412-11-0x0000000000400000-0x000000000040C000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Packed.Win32.Klone.af.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe 3412 jaffacakes118_Packed.Win32.Klone.af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Klone.af.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Klone.af.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\zfhcnfbr.dll
- Size 14KB
- SHA256 273e0d5701df0ab757ebac389fee6141859e4e14e9362b4f2af4c70790ea4128
- MD5 ba739fe0777a5ac29e4f165701bb6af0
- SHA1 9477c390866395079cc097e266c6027b8531b572
- SHA512 a527839eb686a18e349281781aebdb094372acf7a68b0ec8b8a8d974d01b0ba95ec936a9d946b326bbc5bf299352dbaa85cda59fba370671d62c640b4458cc3c
- SSDEEP 192:6lv7ekGOuSfw7Jqto+dQpZE34hfNFNct10VEyX2qG2laTyC8mpiKPcJ1S4MJEsBQ:6lj1GOucckqQ4ct2VS0ln/Gus74
- TLSH T1EF52AE391DBB247CF95B52374DCBC74FF181D73A806ABBE0C6E41A0F78615220996C49
- MD5 SHA1 SHA512 SSDEEP TLSH