Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.BitMiner.bfj.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.BitMiner.bfj.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.BitMiner.bfj.exe
- Size 2.1MB
- Sample261015-1cv8msed39
- SHA256 b74d0ecd4aa14647beae8f92df09d52965e6a8bc3aaa7356d879fe7f9d2e6876
- MD5 e6a2596eaae19e111de1c4ba5ae7a8ca
- SHA1 2ffc362361397a2d656a4669b20d57ab47e146a9
- SHA512 1b01281ed190975fa4afd3502c2f74177fa9578fdb2b9d8f81ffd72b0397c8b0f58d1388bf8e6e0d627ebb4fc6e7b0d28e1c710108d08e9959fc5462dbddf918
- SSDEEP 49152:indf3VFzIhuI7TpiP3HplOhWpX0q5VWy7EeNLvg:i93DGaP3HplOhWFPtQALo
- TLSH T1D8A5D0117281C03EF4BB50F2C9BE8AAE48996F511B5921FB63C40E5E5F714E2AE3251F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
description ioc Process File opened (read-only) \??\PHYSICALDRIVE0 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32\ = "C:\\Windows\\SysWOW64\\twinui.appcore.dll" jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32\ThreadingModel = "Both" jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048} jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\ = "ActivationHints" jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\AppID = "{bdbed08b-7fb7-4eea-afd0-53de534cb638}" jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C231048-7C23-1048-7C23-10487C231048}\InProcServer32 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Token: SeIncBasePriorityPrivilege 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Token: 33 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe Token: SeIncBasePriorityPrivilege 1688 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91 PID 4740 wrote to memory of 1688 4740 jaffacakes118_Trojan.Win32.BitMiner.bfj.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.BitMiner.bfj.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.BitMiner.bfj.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.BitMiner.bfj.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.BitMiner.bfj.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-