36c6e8e7a96ace62ecff1ff6c76c98efb9b880b8924f1fef86668f6a3155bc79

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Hosts2.gen.exe
Size 194KB
Sample261014-mbemlsbv4y
SHA256 36c6e8e7a96ace62ecff1ff6c76c98efb9b880b8924f1fef86668f6a3155bc79
MD5 7552288e6a6fed81677678ab838b6280
SHA1 5d915e53b4addb3f15fccdbd6ec76acceafda84b
SHA512 9780d89d781e7bdc17f7fbf9803b66028c0b2e315652f6f3ebee0750d1c07e499db317f79b03f9a23e9bcf9583a5938a4c46bb7f21843fc50ebc98d3f65d631d
SSDEEP 6144:9FkwAGQPFkXWvYK7sT0bKSL0qPe7qWdMc+noS:vkcQPyONKSL0B7qWPqoS
TLSH
T1281412B2508183D6F35D48F0A27FC50B0091AFFE8BC07E54A61836B7E9694F3654FA96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	win.exe

Executes dropped EXE 2 IoCs

pid	Process
2856	win.exe
3268	Project1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4876-0-0x0000000000400000-0x0000000000474000-memory.dmp	upx
behavioral2/memory/4876-20-0x0000000000400000-0x0000000000474000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Hosts2.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Project1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 796	4876	jaffacakes118_Trojan.Win32.Hosts2.gen.exe	89
PID 796 wrote to memory of 2856	796	cmd.exe	91
PID 796 wrote to memory of 3268	796	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hosts2.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hosts2.gen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2F15.tmp\start.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Users\Admin\AppData\Local\Temp\2F15.tmp\win.exe
    win.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\2F15.tmp\Project1.exe
    Project1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Project1.exe

Path C:\Users\Admin\AppData\Local\Temp\2F15.tmp\Project1.exe
Size 361KB
SHA256 1d5db1ae603734aa763d68a50ebbf660aeba4a16845d1a9c39e60ef3741f14ba
MD5 6c20cb70df69c7209d839c6ff8d32bda
SHA1 03707fe6ea71db97f4c509b3bf1a3c0c027ae925
SHA512 a098f0ff8c75874e6648150fc3b666f0848cb0bea1be0cc236c209b481cfbd422bd030dfdcb89899c950a6ecc31ba79e42c10246e68974757574020a467d356a
SSDEEP 6144:bjb9Jf117o1jqRnPDGVxmMMFeLOy7drQGZEAYYmQfP8Lf2l:Hb9J91c1APqVx/VLO4EAC9fc
TLSH
T197745D72F6D08437C2732A7C9D5B53A89829BE913D2868466BE91D8C5F397C138393D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

start.bat

Path C:\Users\Admin\AppData\Local\Temp\2F15.tmp\start.bat
Size 34B
SHA256 1ec0ce794c834396d3c76a740483f1311302ce914836359e9f19b8e3f95c02dc
MD5 6c8ae4f60a451f794f170f211d804f25
SHA1 847033166ab8308cf23466572634f072b147faa4
SHA512 364b826c4a52105ebadc12f4bdf628b19c3523ef9f2aa319444386d6fac64bc3047b0ac41a847a138a1e8955eb4374d177325516c06ce757ffb7fa82d2de2801
MD5 SHA1 SHA512

Submit Download

win.exe

Path C:\Users\Admin\AppData\Local\Temp\2F15.tmp\win.exe
Size 19KB
SHA256 a217705061325a0688c9b382a424693ee78ecda6f163f2b26eec9b54a228d3f5
MD5 f9924725428f0ac758610ac09bda0f46
SHA1 92d73e277d972e56e2551b28196f470598adc943
SHA512 d0763236bb51078db42640f2c32caadf21c12a02b556ac788b315d82b3c6ad695a73de8a38f966d956eb6c8b1e16b03a0152dae2861fbd1e70cb9b7f5a93f452
SSDEEP 384:HOzekjGyyCMy8NYEHmmVp1NmRvDHJp17HoSiKDDbGEgWBanp5:5C38NYElbcBJP7XRKEWn
TLSH
T1C0921956F483D071E016DBFD5D97D14BAB3B36102E1A41C9B5EE2FDCAE9AB48302C14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-17-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3268-21-0x0000000002130000-0x0000000002131000-memory.dmp

Download

memory/3268-22-0x0000000000451000-0x0000000000452000-memory.dmp

Download

memory/3268-23-0x0000000000400000-0x0000000000461000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x0000000000474000-memory.dmp

Download

memory/4876-20-0x0000000000400000-0x0000000000474000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads