74d235d3bc0f26c51f396d55bed02d675e25004ff66ea2941122e25bc7aefcfb

Analysis

max time kernel
11s
max time network
2s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Size 66KB
Sample261014-krvmnasscy
SHA256 74d235d3bc0f26c51f396d55bed02d675e25004ff66ea2941122e25bc7aefcfb
MD5 aee3daec853e97b2dfa38a2e737ede08
SHA1 6a1171570b45f26849eee2ba6d3787a0dce24b6e
SHA512 6b472b1f24bf4ccf3327d3192bbfd88c37191c98d8b50589b89cee5399b2ff3519caca11b0dc925e8f3a11597081361ad3f71fcf7f6726594db7b3ae3c54a951
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+uRrfFkWGq6cjTA9:U6jI9XJy7rGrdkWGqzjTA9
TLSH
T1FE639C5FD757C1A7F894383080224F71C6A5EE0AD063BA1FD260BB7FE8B128389655B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 discovery persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x002800000001c426-6.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4ea-19.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
1576	MSWDM.EXE
3700	MSWDM.EXE
4680	JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
5068	MSWDM.EXE
5404	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev1563.tmp	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
File opened for modification	C:\Windows\dev1563.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	MSWDM.EXE
3700	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1576	2444	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	89
PID 2444 wrote to memory of 3700	2444	jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe	90
PID 3700 wrote to memory of 4680	3700	MSWDM.EXE	91
PID 3700 wrote to memory of 5068	3700	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1563.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Banker.Win32.Banbra.vwsb.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
    3⤵
    - Executes dropped EXE
    PID:4680
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev1563.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5068

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE

Path C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_TROJAN-BANKER.WIN32.BANBRA.VWSB.EXE
Size 66KB
SHA256 346896dc28d01d15cf41d649d10eb1bd33a80fd821e15235f14de3ed841ddd47
MD5 87802becd641396647390b46df0f297d
SHA1 a151e774d2219584b1bbd8cf906d8e73f56b89bf
SHA512 b7d1d89e022640da76315442e33fdc4be90945b1824b18e864dd7c7f04b1e7f7451397938866e138ff311ba2e24ccebec3b9e7f7322b0afe18b78bf8712d1b28
SSDEEP 1536:fSTjtALMd6bE9XJuFrvJ70z+uRrfFkWGq6cjTAO:U6jI9XJy7rGrdkWGqzjTAO
TLSH
T1D8639C5FD757C1A7F894383080224F71C6A5EE0AD063BA1FD260BB7FE8B128389655B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 39KB
SHA256 b335efead42f137fdbba0ddcfa686b69bc740d8dff4fd7db356d53079d6c96bf
MD5 2d5a83d65cc8c92bfc27af837752918b
SHA1 f8ecac9ad1d5d56f239fea9e2c159d38afbca7fa
SHA512 a593d7f684fae908bfa73a54b51ce60df33d47e6ed0efff849e9e90686c4452f895c34200f87e951f75a916191f77bfcc15318ffdbe297ef4e113633ac49d96a
SSDEEP 768:BdSTj3dALMNyGtT4bE9XJuFbvvJ70TxLdeVRbY10:fSTjtALMd6bE9XJuFrvJ70z+u0
TLSH
T1F7037C6FC70BC0EBF984243045155EB9C4A9DF0EE053855FCBA09B8FA8F129B85945F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev1563.tmp

Path C:\Windows\dev1563.tmp
Size 27KB
SHA256 ca656fda1f8fea01307a97156e105792a40eb2e1968c057643f4bb21e81738df
MD5 9dbb82fb602aa42b131c55c5d136dc9c
SHA1 4f6d5c48f68b4a94b08960788b4660b8f6cf318d
SHA512 b1f5c52b7e7590625161bbe2f53dfd95bed88ab37b5ae31736c087f61e3b6a449bd782a18f028d869ac2dd9052f4d16254d89f746040f02f1608b5e5cad61328
SSDEEP 384:KTvR4JqsYPGyur9idnY89fgIXtee3HX6zUMsgUqjX17E+qu+S2nfPjIREaFgW:wR02G9GnF4NrIMWG5ErjS2HjIREA
TLSH
T14FC28C54B7E0D625F879397584A38F111B66BC298CB4BA2B70107F3EEC323929D37664
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1576-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2444-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2444-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3700-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5068-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5404-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download