Overview

overview

7

Static

static

3

jaffacakes...gh.exe

windows10-2004-x64

7

jaffacakes...gh.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    96s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Virus.Win32.VB.gh.exe
  • Size 3.4MB
  • Sample261014-p5dnhsds2l
  • SHA256 2c229b853ac8928a6c1bb03bed89ff3063b064d78be1d6b232c9620c08735a21
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.VB.gh.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.VB.gh.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\181.#.exe
      C:\Users\Admin\AppData\Local\Temp\181.#.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Users\Admin\AppData\Local\Temp\477.#.exe
        C:\Users\Admin\AppData\Local\Temp\477.#.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Users\Admin\AppData\Local\Temp\429.#.exe
          C:\Users\Admin\AppData\Local\Temp\429.#.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of SetWindowsHookEx
          PID:3472
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\905c0769f9a06c95a24ddf945\909.#.exe
      C:\905c0769f9a06c95a24ddf945\909.#.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2864
      • C:\905c0769f9a06c95a24ddf945\187.#.exe
        C:\905c0769f9a06c95a24ddf945\187.#.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\905c0769f9a06c95a24ddf945\643.#.exe
          C:\905c0769f9a06c95a24ddf945\643.#.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\905c0769f9a06c95a24ddf945\352.#.exe
            C:\905c0769f9a06c95a24ddf945\352.#.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • NTFS ADS
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2572
            • C:\905c0769f9a06c95a24ddf945\410.#.exe
              C:\905c0769f9a06c95a24ddf945\410.#.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5536
              • C:\905c0769f9a06c95a24ddf945\161.#.exe
                C:\905c0769f9a06c95a24ddf945\161.#.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4160
                • C:\905c0769f9a06c95a24ddf945\111.#.exe
                  C:\905c0769f9a06c95a24ddf945\111.#.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • NTFS ADS
                  • Suspicious use of SetWindowsHookEx
                  PID:2656
                  • C:\905c0769f9a06c95a24ddf945\284.#.exe
                    C:\905c0769f9a06c95a24ddf945\284.#.exe
                    9⤵
                      PID:2616
                      • C:\905c0769f9a06c95a24ddf945\686.#.exe
                        C:\905c0769f9a06c95a24ddf945\686.#.exe
                        10⤵
                          PID:1508

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            patcher.exe
            • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
            • Size 3.4MB
            • SHA256 2c229b853ac8928a6c1bb03bed89ff3063b064d78be1d6b232c9620c08735a21
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            os_update_handler.exe$
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
            • Size 3.5MB
            • SHA256 962b0083e682c2090abd00ac7408e44a2f7158fe8bd164ebf4938d06dfb765c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jhat.exe$
            • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe$
            • Size 3.4MB
            • SHA256 849e1ef2dddcfdf050743b16652ea9c1ea8a663db20aab5c65e047e450fa5fc8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jinfo.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
            • Size 3.4MB
            • SHA256 375d7f1b6486427b61c1c4f7e52c58f9c31bcc1816acd449accee309f29f3ad7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            jinfo.exe$
            • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
            • Size 3.4MB
            • SHA256 78432d76f14bc9033cf76c6a0c42f49dce6df21343ae94077f4545da9b25599c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rmid.exe$
            • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
            • Size 3.4MB
            • SHA256 d9d772702019af97dece272ea1bce31a1d27c83de1f52b0107d72cdfa7a3700d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download