4f9176044968b214465c9147ffa6a2be5265614d2ca6d992052fc97d9dd49f6a

Analysis

max time kernel
11s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 339KB
Sample261014-kr61passdw
SHA256 4f9176044968b214465c9147ffa6a2be5265614d2ca6d992052fc97d9dd49f6a
MD5 aacd416ec48f44daedfe077645a863a3
SHA1 329e822bc298d8f5b8456da6d3229dc0ec139b8b
SHA512 d74ef5fc3f6f96e40466a3d7fbf97105d093ed7f1f01611a2d9e50c224dea4abdc14663e25d0787120acf347f1f2a14d2a0a0accb06f39c7b0d67e436354b228
SSDEEP 6144:XUZyzy8+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISvK:5H+kjxo8ISXgJW7jxo8ISi
TLSH
T160742749EA8294D9E0854833DE45A639B6285CDA9C4E46477021FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001c579-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c586-13.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1268	MSWDM.EXE
5284	MSWDM.EXE
5132	JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
2856	MSWDM.EXE
2336	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev9CE2.tmp	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev9CE2.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5284	MSWDM.EXE
5284	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 1268	3528	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	87
PID 3528 wrote to memory of 5284	3528	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	88
PID 5284 wrote to memory of 5132	5284	MSWDM.EXE	90
PID 5284 wrote to memory of 2856	5284	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1268
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev9CE2.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
    3⤵
    - Executes dropped EXE
    PID:5132
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev9CE2.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2856

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 339KB
SHA256 7d344ca27c00de63efa6354589529cf30e7b77e077f84cb70900f28304230aec
MD5 c55d96a0002e948dc070c62e25a05553
SHA1 39439600a0f40913f9e922db087b17808a17e72e
SHA512 378e4b0aa648267f029123420855e43105bdd718464d03a63515bc4467a1b6f5cbb4fe8d62863d34ee545ad8dcdb6ff3713ee4687b6d26fb58737c33c7d09113
SSDEEP 6144:r+OEXE1Vxo83ISv+CgLNWLEXE1Vxo8ISvk:r+kjxo83ISXgJW7jxo8ISM
TLSH
T181740652EA8694D9E4858833DE41663976241CEA5C4E4A477021FFB23FF1BF34A329DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 339KB
SHA256 5d9804535e3d095f113919e794dc7384beda6d826e4792664a7e3ad8aed54dc4
MD5 3b73e60cbe15e84f7855d5fbf2c684b6
SHA1 887b50702127a7f536bd2961b990ad033b558835
SHA512 525ca1374fb47c060ac01eab2563e793a94608f88046066ce8bf2303d08849ec466f478cf90f8cfca1131bf396ef3c284aba4824f220947b23eae7730985cd64
SSDEEP 6144:XUZyzy8+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISvk:5H+kjxo8ISXgJW7jxo8ISM
TLSH
T18C742749EA8294D9E0854833DE45A639B6285CDA9C4E46477021FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 39KB
SHA256 28370e51c9b65405da275d974b38201ea6873608833d9b55dea0fe88a09885b6
MD5 828b0c117250fb2c2c95e76df2dba383
SHA1 3db1ecd724177c00041116101c77c692b7bb4e6a
SHA512 3ad4e7e7dcac0a7df30065e00321458c170cefe45b01eee04ffc7faf7e78afd1d78502fcb4c33848ca7aff5be90405d8efa50dc31c669269d4255daea0ccfae2
SSDEEP 768:BdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRIu3:fSTjtALMd6bE9XJuFrvJ70z+Iu3
TLSH
T1FF03D0AE1B59D4FDD6C83530892B9FAECA3DFD17C152036B0B200B0F2CB605B5D995A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev9CE2.tmp

Path C:\Windows\dev9CE2.tmp
Size 300KB
SHA256 3bc9afaf7574b6d5abbbd11b571aae45abd24fc1d5691d4927444ec79dd0294b
MD5 a6d64056ad6ca84534143757fd782d7a
SHA1 19e365305ceabad649ed67278587d2f80b94c78e
SHA512 6801ea8a1cf5f2112739bb9c5bb576b8cce4e952dcc5f2165568b80d6b80b9459f6dbda84f0db5061ca108b42c0d30d4a71ded228e1b04d4182f9f8e931afab4
SSDEEP 6144:r+OEXE1Vxo8ISv+CgLNWLEXE1Vxo8ISvH:r+kjxo8ISXgJW7jxo8ISv
TLSH
T173640551EA8294D9E0854833DE45A63976281CEA5C8E4A477025FFB23FF1BF346368DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2336-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2856-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3528-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3528-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5284-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download