b47e5f94b07d920ae549bc409a9ac345623ae8b378d25e214a749f39d8648794

Analysis

max time kernel
12s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 55KB
Sample261014-krss3asscx
SHA256 b47e5f94b07d920ae549bc409a9ac345623ae8b378d25e214a749f39d8648794
MD5 bcc4cc9e46fe964fa0cd69fee2f93fef
SHA1 e205c125409eef64bde0b08c4fb2846d167b0b9a
SHA512 e093155a988e46a7acae8393c17db457a05dec75364ad1839bf5f7966949aa91c3f13b000179d1044bcecb41079463b8412c2108729c01ab6030402ada7495cb
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+PMRlcwuBiJR0:U6jI9XJy7rElcJiJR0
TLSH
T10F438C4F9B36C0F7C984543004166E75F669DE29E123CA1BCB20E7572CB2497A4EC1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00080000000243d6-3.dat	aspack_v212_v242
behavioral1/files/0x00070000000243d8-16.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
4840	MSWDM.EXE
1604	MSWDM.EXE
3124	JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
1416	MSWDM.EXE
3240	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev94E8.tmp	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev94E8.tmp	MSWDM.EXE

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1604	MSWDM.EXE
1604	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4840	4408	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	86
PID 4408 wrote to memory of 1604	4408	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	87
PID 1604 wrote to memory of 3124	1604	MSWDM.EXE	88
PID 1604 wrote to memory of 1416	1604	MSWDM.EXE	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev94E8.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
    3⤵
    - Executes dropped EXE
    PID:3124
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev94E8.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1416

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE

Path C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
Size 55KB
SHA256 4280506b8e2e0ae13b81319e98f640e0cb7a9f86a0269ff96f181d08dd63e1cd
MD5 0100a3dc5b437eababa0b16a6ffba6d9
SHA1 4f02b991dbc29299f725dbd491f95fe116d363ad
SHA512 28c6de35d55c0f4db80c0ce1bb7f6773b87a78a7527b7d254a5bd7445e2746c942d0c910dadef9d7800ed26c31d8e4117c0b0cc9e39cb0d6d366842be2e7fb55
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+PMRlcwuBiJRh:U6jI9XJy7rElcJiJRh
TLSH
T1F6438C4F9B36C0F7C984543004166E75F669DE29E123CA1BCB20E7572CB2497A4EC1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 39KB
SHA256 bc3b5c4de7a6952467ddf253490c3ec09e1bae1ce84d0f3475ceae882c282c19
MD5 8677371d15143c2434370ad541199b2e
SHA1 d489dd88ccb9b210ed4f315fa60e2164d8373937
SHA512 1011234787f52a638ab7d09c7f3215776f20b05128cf2eab203e94cc5176c305f67e8d16fb585c4ba4fe7eb2bb8c9cb0e609e6f98eb9971d3f87137647049401
SSDEEP 768:BdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRPS10:fSTjtALMd6bE9XJuFrvJ70z+PM0
TLSH
T148036A5F873BC4EBD988253144155F75F529EE0EE053C62BCB20B78B2CB209798885EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev94E8.tmp

Path C:\Windows\dev94E8.tmp
Size 16KB
SHA256 27d6644771a935ec0547258dff56bbfba151f2addf09c51b1edc6a9a3207d2c5
MD5 8ad17f33bdcc0ea294e074e0e74cad3b
SHA1 81b4608a3e11a24157e9c22ac45ff1b12d8c476e
SHA512 f5337e5edc0386c597d8ae787e6f4a7fdac393d2aee55eb7b3a15cf82d9fb5757724d424aab0959a0c4ebf79c9cdd560d9157295a26edffe39ff6f056a526ded
SSDEEP 192:b16jkqnvSa3zKk93Vcy3PRC6eHXNaZ9DqW/zV/3sT1RRlaGVzOQX3iZznnD7N+O:QjkEvrescyPte3NaZ0T1RFVaQXSNnDR1
TLSH
T17372188BEE500033C1E481B45456BA7BE7EEC970232EDE86DB11C8626963D93B5FD213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1604-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1604-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3240-25-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3240-27-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4408-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4408-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4840-28-0x0000000000400000-0x0000000000414000-memory.dmp

Download