708980062f0a75ede8f46ca9e329f05998859f5638b99cde579f2d07e5148e1c

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe
Size 280KB
Sample261016-e17exs1y9q
SHA256 708980062f0a75ede8f46ca9e329f05998859f5638b99cde579f2d07e5148e1c
MD5 9b7b817d889122ce8c2107122277d1fc
SHA1 cb1e9e73ec67ade98304bcae452518758bde91d6
SHA512 585ee6fbe9d8a32fbc0e167e7a3ae030213153c4e5ab755155bcaff0da5486a64152b68a6ce0e4b0c28736a9fe2a518fd45c752905d1d52ff763f20ef5aae041
SSDEEP 6144:T28A9pFotl2z1zkO+BK+ov0eo6BLpn6wyauOi6ZkY6D:y8Ga/2z1z9hdv06XyauH6OX
TLSH
T100541251A9F394E7EA6E867115B35070DBB3E91442268ACF33284F7B3C70F851A0B647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe
1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe
1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89
PID 1828 wrote to memory of 1164	1828	jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.czzb.exe"
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsp671F.tmp\System.dll
Size 11KB
SHA256 fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce
MD5 4d3b19a81bd51f8ce44b93643a4e3a99
SHA1 35f8b00e85577b014080df98bd2c378351d9b3e9
SHA512 b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622
SSDEEP 192:BPtkumJX7zB22kGwfy0mtVgkCPOse1un:u702k5qpdseQn
TLSH
T1F9324C15135046F3E1D2853C242B3AAB6FB869118AF04E43CFB36852EF386C6AD79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scarcement.dll

Path C:\Users\Admin\AppData\Local\Temp\scarcement.dll
Size 180KB
SHA256 fa294502d4967b110f50ade46b46f127a87dcd5476f7bada8176e5add4a6da61
MD5 aeff6b2886b3668781b4a76a07428638
SHA1 838ac9b41483e3473d3a2e5734f1edf494227208
SHA512 f53cfbc428098d316bc624be043275a7f75db18cbdff722a09ad8a1895ca46612c4a17b5971efe1eb47d6a7ea22f9c857cf46ac9c6f5dfd0f7efdee460cffa7f
SSDEEP 3072:40694SH74APdILu/5z3phHLWfvfLuWDPWnolOcckBG/VGpjPtmOvpS:4H9tb4AIu/V3pevDuWDP3lOSUO
TLSH
T119043B00B650C03CF9BF01FD95F5879CE82A3A70EBAD85CB62E2599A16791E4ED31353
MD5 SHA1 SHA512 SSDEEP TLSH