General
- Target jaffacakes118_Trojan.Win32.Fsysna.anoh.340aebe8d2f9883e31aa0fcea6dada63
- Size 941KB
- Sample261014-marwjsbw4p
- SHA256 38286026f602ec7a13abfe16bfa320ea291218c4b42c158749df7453d0081fff
- MD5 340aebe8d2f9883e31aa0fcea6dada63
- SHA1 cd71a959c4a32f20326dad1162f79e5aaecd1705
- SHA512 5f8083d9df505ded6749e1ce9f6861419fffa58cf93cef18f2b0d1bec62a7a028ae5ac9827f514943a7062132a8d5916bd96f1658c51589496d345305f938a7d
- SSDEEP 12288:fsolIorqw9LltVaPLgEjYHx+2/SzzdX+/GU0N6mphZWuFZWOnXF+g4j:x2XwZl+PUWYHxXCSGFph7ZDXF+7
- TLSH T10A25AF72F2809477D4331A398C1B82E95929BF343E24A94B77E63F5C5F79281391A2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Fsysna.anoh.exe
Resource
win10v2004-20260911-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Fsysna.anoh.exe
Resource
win11ltsc2024-20260911-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_Trojan.Win32.Fsysna.anoh.340aebe8d2f9883e31aa0fcea6dada63
- Size 941KB
- SHA256 38286026f602ec7a13abfe16bfa320ea291218c4b42c158749df7453d0081fff
- MD5 340aebe8d2f9883e31aa0fcea6dada63
- SHA1 cd71a959c4a32f20326dad1162f79e5aaecd1705
- SHA512 5f8083d9df505ded6749e1ce9f6861419fffa58cf93cef18f2b0d1bec62a7a028ae5ac9827f514943a7062132a8d5916bd96f1658c51589496d345305f938a7d
- SSDEEP 12288:fsolIorqw9LltVaPLgEjYHx+2/SzzdX+/GU0N6mphZWuFZWOnXF+g4j:x2XwZl+PUWYHxXCSGFph7ZDXF+7
- TLSH T10A25AF72F2809477D4331A398C1B82E95929BF343E24A94B77E63F5C5F79281391A2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies security service
-
Windows security bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Windows security modification
-
Adds Run key to start application
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1