6ffc30be8c3d202eaee11f0961d752c9e7762f48f2ed3e2fd22d69f9e9b96ba3

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe
Size 261KB
Sample261016-e2yjeaff48
SHA256 6ffc30be8c3d202eaee11f0961d752c9e7762f48f2ed3e2fd22d69f9e9b96ba3
MD5 b65a73263102c6d13301d1d889897cea
SHA1 8d8386e9b37c46cdb65265ef130c15aa8f47c588
SHA512 dac1e3a0fbd951550f5f57ea6122492af8e24ecd2f6b28b12e28f5af33e086fa6cb387c375d54537da8070ad6ce3680a2ef64f4f72e70abb598c20b27c12bda9
SSDEEP 6144:DUjRwJGL/MDs5ZdeFSXeuU1WIukjTW1tMtcQ+Fdhzi:DqMGbMdFSXBU13uk8tMtcQKf2
TLSH
T158441211A9C0D9B7E8B296355D77F73AEBB862261020134F57581FAF3F34380950ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe
4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe
4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4324 set thread context of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89
PID 4324 wrote to memory of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89
PID 4324 wrote to memory of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89
PID 4324 wrote to memory of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89
PID 4324 wrote to memory of 4904	4324	jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.Zerber.ezzq.exe"
  2⤵
  PID:4904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx6142.tmp\System.dll
Size 11KB
SHA256 982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b
MD5 0ff2d70cfdc8095ea99ca2dabbec3cd7
SHA1 10c51496d37cecd0e8a503a5a9bb2329d9b38116
SHA512 cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e
SSDEEP 192:eK24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlASl:u8QIl975eXqlWBrz7YLOlA
TLSH
T12B325C02135481F3E4918138C86B3A276B6A15029BF98E57DFD39646BE30BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rivages.dll

Path C:\Users\Admin\AppData\Roaming\rivages.dll
Size 72KB
SHA256 00c9037adfce0c649c02fe5ecfeb998f3a3e44ab637fca01efe5826d880a3f3a
MD5 ad71a3a39d2b59c493f1158353228ab4
SHA1 a27a4c87131769ba65963b08835b191745647a53
SHA512 eeb490576728a2cb8586e19aa4c4809d4dcf5bd999f47397cf86c6f54da486d6ad23366720ffdc3ccdb0c9c6371522e4992f0024cbdb5a1473d314fac136cedd
SSDEEP 768:qmDdydrW5kQF/7LY7NWeWN+bEJmYKHZQa3vGZ+jIdKR:VDdydrMV7ie+bEJmLea3vaKR
TLSH
T1CC73861232EA365EEAF237B81CBD23525F7B3D529DB4D74F0A60305C0DB5A819921B27
MD5 SHA1 SHA512 SSDEEP TLSH