50fbeab408c14702445bca1dada8f5e12b841a8b3fd621f02f499be638cd3d18

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe
Size 294KB
Sample261016-e15lbs1y9n
SHA256 50fbeab408c14702445bca1dada8f5e12b841a8b3fd621f02f499be638cd3d18
MD5 5376187e8085dd4788c00af5d43a51ad
SHA1 16cf36ec16663b04c9a6061487c202c76e1bf0e3
SHA512 84d51b403f3be1de59172eed1fd557d10e40fa3212aa4ebae389879934b5fe97e264d2e5eac3de6a07785fea182edd2e0bffedc8866f7961315f553975e02f87
SSDEEP 6144:Z92OYjxiPbuOrUYRCvDraMwR6TfacaowzgcjOe/JHNc:PYwJDRC/+Kfaca7zgcjOe1W
TLSH
T1ED542227A7E181DFEC9544724FFA7EB9DF3D0A0157A2994783011EBF68418E781062EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe
2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe
2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89
PID 2528 wrote to memory of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89
PID 2528 wrote to memory of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89
PID 2528 wrote to memory of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89
PID 2528 wrote to memory of 2244	2528	jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ctai.exe"
  2⤵
  PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx1564.tmp\System.dll
Size 11KB
SHA256 98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b
MD5 b8992e497d57001ddf100f9c397fcef5
SHA1 e26ddf101a2ec5027975d2909306457c6f61cfbd
SHA512 8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c
SSDEEP 192:PPtkumJX7zB22kGwfy0mtVgkCPOs81un:E702k5qpds8Qn
TLSH
T19A325C15135046F3E1D2853C142B3AAB6FB869118AF04E43CFB36852EF386C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wainscottings.dll

Path C:\Users\Admin\AppData\Roaming\wainscottings.dll
Size 100KB
SHA256 7addc46bee320488022fd95dc2b9008fc43b8489fd868a5aa94c6640074dbac3
MD5 2e6607bf2a5f71df7f051764cc006ee8
SHA1 159abcb3ca839ba9113eb6de51fb8d3ee7d93ce2
SHA512 65ef1f21598534c5f5c8af4cb4c8e1cbb77b41c2e08d4923a6b25822a31971b43b0b428e225cbf4f7fd50ccafea3bedb12e5f07f4bb9ca2d1d7520af5eea957d
SSDEEP 1536:gAK+13zMziqsS422XtQvKoJHWoXETJ1MH6wbAV6M1jBPtp09Om8:gozMziY422XqzEJ1W9X
TLSH
T116A32A52B5D9C073F6050D7C846763D20A3FB87BAFA5F6832644119E9D323C25B7A38A
MD5 SHA1 SHA512 SSDEEP TLSH