4f9176044968b214465c9147ffa6a2be5265614d2ca6d992052fc97d9dd49f6a

Analysis

max time kernel
13s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 339KB
Sample261014-kr61passdw
SHA256 4f9176044968b214465c9147ffa6a2be5265614d2ca6d992052fc97d9dd49f6a
MD5 aacd416ec48f44daedfe077645a863a3
SHA1 329e822bc298d8f5b8456da6d3229dc0ec139b8b
SHA512 d74ef5fc3f6f96e40466a3d7fbf97105d093ed7f1f01611a2d9e50c224dea4abdc14663e25d0787120acf347f1f2a14d2a0a0accb06f39c7b0d67e436354b228
SSDEEP 6144:XUZyzy8+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISvK:5H+kjxo8ISXgJW7jxo8ISi
TLSH
T160742749EA8294D9E0854833DE45A639B6285CDA9C4E46477021FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a0000000243d9-5.dat	aspack_v212_v242
behavioral1/files/0x00090000000244a6-18.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
3160	MSWDM.EXE
3312	MSWDM.EXE
4580	JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
4372	MSWDM.EXE
4524	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev724D.tmp	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev724D.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3312	MSWDM.EXE
3312	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3160	1196	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	87
PID 1196 wrote to memory of 3312	1196	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	88
PID 3312 wrote to memory of 4580	3312	MSWDM.EXE	89
PID 3312 wrote to memory of 4372	3312	MSWDM.EXE	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3160
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev724D.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
    3⤵
    - Executes dropped EXE
    PID:4580
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev724D.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4372

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 339KB
SHA256 d1a68b967e333ceef7fc888ee8435ac3002b9fea59c39145d81a1d6409393620
MD5 512a7e6ff307a000a772473cc3284388
SHA1 b6fc18bfa3aafe18e5cc550cd91ae287c287fe2a
SHA512 91d77f1c5c13f5f011be08fe7a8c26572a7a6f046cbe5b07c0578d4f45c7c596e99e99cab81ab32268a35021eab91a6390b25ef6f54e4e9b6ffdd60e55f5cfdf
SSDEEP 6144:XUZyzy8+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISv1:5H+kjxo8ISXgJW7jxo8ISt
TLSH
T1B7742749EA8294D9E0854833DE45A639B6285CDA9C4E46477021FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 39KB
SHA256 28370e51c9b65405da275d974b38201ea6873608833d9b55dea0fe88a09885b6
MD5 828b0c117250fb2c2c95e76df2dba383
SHA1 3db1ecd724177c00041116101c77c692b7bb4e6a
SHA512 3ad4e7e7dcac0a7df30065e00321458c170cefe45b01eee04ffc7faf7e78afd1d78502fcb4c33848ca7aff5be90405d8efa50dc31c669269d4255daea0ccfae2
SSDEEP 768:BdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRIu3:fSTjtALMd6bE9XJuFrvJ70z+Iu3
TLSH
T1FF03D0AE1B59D4FDD6C83530892B9FAECA3DFD17C152036B0B200B0F2CB605B5D995A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev724D.tmp

Path C:\Windows\dev724D.tmp
Size 300KB
SHA256 3bc9afaf7574b6d5abbbd11b571aae45abd24fc1d5691d4927444ec79dd0294b
MD5 a6d64056ad6ca84534143757fd782d7a
SHA1 19e365305ceabad649ed67278587d2f80b94c78e
SHA512 6801ea8a1cf5f2112739bb9c5bb576b8cce4e952dcc5f2165568b80d6b80b9459f6dbda84f0db5061ca108b42c0d30d4a71ded228e1b04d4182f9f8e931afab4
SSDEEP 6144:r+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISvH:r+kjxo8ISXgJW7jxo8ISv
TLSH
T173640551EA8294D9E0854833DE45A63976281CEA5C8E4A477025FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1196-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3160-30-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3160-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3312-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3312-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4372-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4372-19-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4524-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4524-29-0x0000000000400000-0x0000000000414000-memory.dmp

Download