Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Loader.f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Loader.f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Loader.f.exe
- Size 38KB
- Sample261014-mflaysbx2k
- SHA256 9dbd784d22debbd089bde173cca707c94178958c6e3aed1616453633baea5893
- MD5 264aeb7713b54f89cb66a7007d546d97
- SHA1 8e6099319a879e3487e428ec8a614d947f922f4a
- SHA512 bf0da6003d7bd6978d4049ba6f82c616ea5106744faa39d83d4af2f9f9d39b01bce71b32c0b64fa069a7dec18b7fa410c73717bc28a31b4508f1f519fba70e51
- SSDEEP 768:P3PNGh5AEl3DXvBIsR7TZGTOVRp4nrdP5N1CETAgYmi5GIFEEUfz:tmt1jusiTuGnrp/xAgm5G+EE0z
- TLSH T1AF03E06807128B0DD39A5BBAA893923EFBB3064C4503C83DDD3AFAA17901F15E67C157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2784 slddvrsmdv.td - Loads dropped DLL 1 IoCs
pid Process 2236 rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\pqepgvbuav.sd jaffacakes118_Trojan.Win32.Loader.f.exe File created C:\Windows\SysWOW64\slddvrsmdv.td jaffacakes118_Trojan.Win32.Loader.f.exe File created C:\Windows\SysWOW64\SetUp.inf jaffacakes118_Trojan.Win32.Loader.f.exe File opened for modification C:\Windows\SysWOW64\SetUp.inf jaffacakes118_Trojan.Win32.Loader.f.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\windows\run.bat jaffacakes118_Trojan.Win32.Loader.f.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Loader.f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language slddvrsmdv.td Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5504 jaffacakes118_Trojan.Win32.Loader.f.exe 5504 jaffacakes118_Trojan.Win32.Loader.f.exe 5504 jaffacakes118_Trojan.Win32.Loader.f.exe 5504 jaffacakes118_Trojan.Win32.Loader.f.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe 2236 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5504 jaffacakes118_Trojan.Win32.Loader.f.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2236 rundll32.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5504 wrote to memory of 2784 5504 jaffacakes118_Trojan.Win32.Loader.f.exe 88 PID 2784 wrote to memory of 2236 2784 slddvrsmdv.td 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Loader.f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Loader.f.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\slddvrsmdv.tdC:\Windows\system32\slddvrsmdv.td2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\pqepgvbuav.sd,mymain3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\pqepgvbuav.sd
- Size 64KB
- SHA256 fbbb362a7b08c1609bdf2efcf2f4b6b5400bbb429f7846f308f2188ef5e85870
- MD5 50d41e629c8446a34e9e1bf254059979
- SHA1 f80a0f2f754e89bac83961496c4ba9a364b8ab65
- SHA512 8ea23682786eb8398101b023d30ac44173428d2d8ae74bc70409533cc3152133208734709b499e0dbaff0315858b1d7a5989b4463cd94a110c836a8af14926d1
- SSDEEP 768:Im17XC1QmdCzPAYTeaKKbz0NT/aBe16Zz3aex+QcAB/NIb1KeQkji0tocu9CAqk:IO7GCr+s0NTCB/ZjFkwybdQktocuRj
- TLSH T1BD537D12B98044F3D34906756591CF3B563F79201BF488D36F2ADAEA1D322E6E53B2C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\slddvrsmdv.td
- Size 36KB
- SHA256 5328811ff34ec705a47910e0df2495222ceef8eac50e7267e1bac03ec540ae6c
- MD5 eded172da4b04f34c46d4c3a2198a2d3
- SHA1 2b39318c5b9a2c62ddd1912f2d68419d08e475a3
- SHA512 472ef9537e69e42b10339ab792557096af3b6891deb6ad08cb3b433bc8dc79b0e86447ec56d5c3fba45a2d85e481e4592eb2fb436b510cb51fedf9246f9a04c0
- SSDEEP 384:bAP7V5+6Cd7v9/zzebq9QyiynxGwCMwoY:bAP7P+NfJPioxGw5woY
- TLSH T196F24B2378C20537C582817198F08B176B3F66661E71C4DFEB946A4A3F31AE9593A783
- MD5 SHA1 SHA512 SSDEEP TLSH