b47e5f94b07d920ae549bc409a9ac345623ae8b378d25e214a749f39d8648794

Analysis

max time kernel
12s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 55KB
Sample261014-krss3asscx
SHA256 b47e5f94b07d920ae549bc409a9ac345623ae8b378d25e214a749f39d8648794
MD5 bcc4cc9e46fe964fa0cd69fee2f93fef
SHA1 e205c125409eef64bde0b08c4fb2846d167b0b9a
SHA512 e093155a988e46a7acae8393c17db457a05dec75364ad1839bf5f7966949aa91c3f13b000179d1044bcecb41079463b8412c2108729c01ab6030402ada7495cb
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+PMRlcwuBiJR0:U6jI9XJy7rElcJiJR0
TLSH
T10F438C4F9B36C0F7C984543004166E75F669DE29E123CA1BCB20E7572CB2497A4EC1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001c498-5.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4cc-18.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5812	MSWDM.EXE
5700	MSWDM.EXE
2496	JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
4836	MSWDM.EXE
2468	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev9611.tmp	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev9611.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5700	MSWDM.EXE
5700	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 5812	6068	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	89
PID 6068 wrote to memory of 5700	6068	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	90
PID 5700 wrote to memory of 2496	5700	MSWDM.EXE	91
PID 5700 wrote to memory of 4836	5700	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6068
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5812
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev9611.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
    3⤵
    - Executes dropped EXE
    PID:2496
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev9611.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4836

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE

Path C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
Size 55KB
SHA256 0d0d1d362b1f9b0fde0efd29b33759edbf77fab1f93bb6171204bec9d86bc646
MD5 30b4a82e2b4866fde625b9a1fce9466a
SHA1 df561d4cf6176a43df2bdf55f387d6a47c6ecf4a
SHA512 3e5c0269014ef3d58fbc291e493fc15c47b897760d23f9b187610dc444354b0e0a5348ab6e1c5ea6d00ae89ce6ffb6b546f44fd86d06b2adb448fff507e6c678
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+PMRlcwuBiJRw:U6jI9XJy7rElcJiJRw
TLSH
T151438C4F9B36C0F7C984543004166E75F669DE29E123CA1BCB20E7572CB2497A4EC1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 39KB
SHA256 bc3b5c4de7a6952467ddf253490c3ec09e1bae1ce84d0f3475ceae882c282c19
MD5 8677371d15143c2434370ad541199b2e
SHA1 d489dd88ccb9b210ed4f315fa60e2164d8373937
SHA512 1011234787f52a638ab7d09c7f3215776f20b05128cf2eab203e94cc5176c305f67e8d16fb585c4ba4fe7eb2bb8c9cb0e609e6f98eb9971d3f87137647049401
SSDEEP 768:BdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRPS10:fSTjtALMd6bE9XJuFrvJ70z+PM0
TLSH
T148036A5F873BC4EBD988253144155F75F529EE0EE053C62BCB20B78B2CB209798885EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev9611.tmp

Path C:\Windows\dev9611.tmp
Size 16KB
SHA256 27d6644771a935ec0547258dff56bbfba151f2addf09c51b1edc6a9a3207d2c5
MD5 8ad17f33bdcc0ea294e074e0e74cad3b
SHA1 81b4608a3e11a24157e9c22ac45ff1b12d8c476e
SHA512 f5337e5edc0386c597d8ae787e6f4a7fdac393d2aee55eb7b3a15cf82d9fb5757724d424aab0959a0c4ebf79c9cdd560d9157295a26edffe39ff6f056a526ded
SSDEEP 192:b16jkqnvSa3zKk93Vcy3PRC6eHXNaZ9DqW/zV/3sT1RRlaGVzOQX3iZznnD7N+O:QjkEvrescyPte3NaZ0T1RFVaQXSNnDR1
TLSH
T17372188BEE500033C1E481B45456BA7BE7EEC970232EDE86DB11C8626963D93B5FD213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2468-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4836-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5700-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5812-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5812-24-0x0000000002040000-0x0000000002046000-memory.dmp

Download

memory/6068-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6068-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download