17125d677c5081f3796609e6461e6777e26e58dde7fa462591139974100fdc51

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe
Size 56KB
Sample261014-k7dn3sfd65
SHA256 17125d677c5081f3796609e6461e6777e26e58dde7fa462591139974100fdc51
MD5 e7483b55fe80eb06442c9dd87edd4b63
SHA1 f1f8eee9f83ccbd0f1d913f6c7a97e5c74485d1e
SHA512 f77bbb5c9ebf5921a1c1b51eb1f7d3e53225f08eb84f5a483bd47af49cd8b00a02ac1900593426e946f11efc961da458220f3493e29fdb6772cb2f433c2e404c
SSDEEP 1536:MwY2ymO+Q9pFoYQ+850tlbMcwO7zfwVlScSn:MNmnWQYF8glbDwOXF
TLSH
T1984302AFAAF89956C343CB39EC9CD67488C808AD1930640B72D10E4483C29E3EFD3913
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cd240773765.exe

Executes dropped EXE 3 IoCs

pid	Process
1620	D01.exe
2396	D01-1501.exe
3160	cd240773765.exe

Loads dropped DLL 2 IoCs

pid	Process
2396	D01-1501.exe
2396	D01-1501.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kav = "C:\\Windows\\system32\\kav.exe"	cd240773765.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jkaback.pak	D01-1501.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\progra~1\KAV\TvPlus.inf	D01-1501.exe
File created	C:\progra~1\KAV\TvPlus.sys	D01-1501.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6020	sc.exe
5036	sc.exe
4888	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5272	2396	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cd240773765.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	D01.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cd240773765.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D01-1501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd240773765.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	D01-1501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	D01-1501.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	D01-1501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	D01-1501.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2396	D01-1501.exe
2396	D01-1501.exe
2396	D01-1501.exe
2396	D01-1501.exe
1620	D01.exe
1620	D01.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2396	D01-1501.exe
Token: SeAuditPrivilege	1872	svchost.exe
Token: SeDebugPrivilege	3160	cd240773765.exe
Token: SeDebugPrivilege	2396	D01-1501.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	D01.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1620	4312	jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe	88
PID 4312 wrote to memory of 2396	4312	jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe	89
PID 2396 wrote to memory of 6020	2396	D01-1501.exe	90
PID 2396 wrote to memory of 5036	2396	D01-1501.exe	92
PID 2396 wrote to memory of 4888	2396	D01-1501.exe	94
PID 2396 wrote to memory of 3160	2396	D01-1501.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Microjoin.gen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\D01.exe
  "C:\Users\Admin\AppData\Local\Temp\D01.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\D01-1501.exe
  "C:\Users\Admin\AppData\Local\Temp\D01-1501.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" config PolicyAgent start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6020
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5036
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start PolicyAgent
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\cd240773765.exe
    "C:\Users\Admin\AppData\Local\Temp\cd240773765.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1424
    3⤵
    - Program crash
    PID:5272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2396 -ip 2396
1⤵
PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

D01-1501.exe

Path C:\Users\Admin\AppData\Local\Temp\D01-1501.exe
Size 126KB
SHA256 9fd114b1c8e2323812a057c7f72ac0205fa8b1182b733244049246bd93d95da7
MD5 0c17dc219ddf4b48cab06482da3e727a
SHA1 c7bfc71fb070ee7d0520d37b8710e46ada13d153
SHA512 7441fea0c263d6dada122c383963f072140ba21da79cd848cb56f8f80d1a676f918b239ac66b37889b7bbd6033ec596ebcd8693c1a40024f82509f18240768aa
SSDEEP 3072:CQ7seRB+b++1Aw+y4YgDSAEBP/l4z93i+FrGNKo:CQ7seRB+b++1Aw+y4YgDSAEZ/lY9kN
TLSH
T1A4C32B464697DFFBE05AA0FE1607EEA6D14C4A188F05F972D12581CC6C82BDC789EC4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D01.exe

Path C:\Users\Admin\AppData\Local\Temp\D01.exe
Size 36KB
SHA256 066fbd86bed4b5631b2bb94743109006d8de6762f21dd46084aaaf0f2df1163f
MD5 1914e403987145177053d2718cae9c6a
SHA1 b98e79db1d7fc76a6ad79b7211ec8375e8db03c4
SHA512 7f8f3a45a587c580c4b5ee961f06ffffd4a8627e21fdb59d3aeac935b3800ab1b480c04b86191f91ac3135e44948940f4935d02e08eaf07aa635578f7b5a11f7
SSDEEP 384:MOE2RHTI4atfHx9lAImNMkZOez2icoga2+RmilS+E0R1Nh4SbDK0s/RfT:PzITtfZjaMfgpcoga26mQBE0j/f61
TLSH
T118F2B513FA1C4422F25A42B1192AAAFBA6627C3019609D0717CBFF591EB4B037DE531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd240773765.exe

Path C:\Users\Admin\AppData\Local\Temp\cd240773765.exe
Size 16KB
SHA256 33c1114b98e1ec294da81644267a99da21e092a2e434a6c8cb7008a3f826376d
MD5 9c10499d876ae06f2b36ed7a4db3cc4a
SHA1 b563b48130c0fdb2a88f23a63256c760048786d2
SHA512 4a48bd90f4b78982db5007b6be4cca6857b0ee451dba21c597d96945e30084c99da201cfee8003d7732eaac5087f85fd2df499ace9f9074e7095fb17e8998c75
SSDEEP 384:jl0WRjJj7415EKXKAMDCnbr9WCVKvrqcf8ok:Y/EKioWCgjqcf8j
TLSH
T117723A4F6B6D0143C2724270285DBB3BE7B9BFB60A9FA113DBC154652C941DA912CF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jkaback.pak

Path C:\Windows\SysWOW64\jkaback.pak
Size 16KB
SHA256 153dc55887a986eb52a8be9008342a66b7b60b8ece2b5e81138309210153d142
MD5 219394ebb12624755e13e8c1f6da342c
SHA1 01c18e9c839263e3baa7f90688543a100cc407ee
SHA512 50dffcddb5fef885388b7041789ec4c05964543d42d0777f3f7f65bcfa117513173a47488e30ace6355def928806492d7c04366343173b492b7bd8d3c148e3e7
SSDEEP 192:Y8neU4NORd9ZTj5OnH3qM3B3IfWrZRvblnHT85ZLfljuCHXF7ue5RodOmikdga:YRUKaA4+XlnHT8vL9uCHXBu0ps/
TLSH
T11A725CE3C683D62BDB9BC0FE33597720C61A17E8302A19428048750D68F2399DE7BB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-20-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2396-25-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2396-45-0x00000000021C0000-0x00000000021C6000-memory.dmp

Download

memory/2396-47-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4312-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4312-21-0x0000000000400000-0x0000000000410000-memory.dmp

Download