Analysis
- max time kernel
148s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Agent.nezlxz.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Agent.nezlxz.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Agent.nezlxz.exe
- Size 454KB
- Sample261015-23cpnaef48
- SHA256 b9fe6ccdafa3d0001bb3840d346bb80d3030116b805281287439faef43063ba0
- MD5 b5faceddf9cf8d36b2c54d7257231860
- SHA1 84c741452b3868e6c265d372ae849e2e385d5470
- SHA512 ecddd205a905ad12166fa684c14be7264306b18c5c20210bc816313663b5258758b4e2b42cc2896dff25f6ad5b46bf518bf93f144e28e61b01f19ed40e3bb7d8
- SSDEEP 12288:Pjwqr+D5V4EwO6Fz0sK+oPmG9jnbGYqvAYokDvdUC1TgwyhsR+ExJpcEi0/3IWVs:rwqr+D5V4poPmG5bY+6/8
- TLSH T164A4E9536ACB0CB6C8A227F49587277693389E354517CBABA744CC3ADFA36C0BD59301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan.Win32.Agent.nezlxz.exe" jaffacakes118_Trojan.Win32.Agent.nezlxz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Trojan.Win32.Agent.nezlxz.exe" jaffacakes118_Trojan.Win32.Agent.nezlxz.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Agent.nezlxz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.nezlxz.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.nezlxz.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4240
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.nezlxz.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Agent.nezlxz.exe1⤵
- Adds Run key to start application
PID:4364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\c:\$Recycle.Bin .exe
- Size 45.2MB
- SHA256 05bbd75bcf524aeda2ae4e74b6793ef139c785e7edb3f88f410f9a46d419d58d
- MD5 debc0df94703eb2e34dea49f8c7af5ed
- SHA1 cf3cbc314d0f05f2515cc794facb78669fb0e59b
- SHA512 cee8a6d5c34375d5ca9d71e7d2d0c44c52788db3abfdb424c6720c5f99cd6c0173c1de1246af910c4de06010ef4b59e948e6160b6313af39f14564c9a440989e
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP