d93569e68cf1ba37e51c31c38b64a9237423078390c9476bec3f220bfa32e592

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Buzus.lbq.exe
Size 117KB
Sample261018-3vd37at19q
SHA256 d93569e68cf1ba37e51c31c38b64a9237423078390c9476bec3f220bfa32e592
MD5 95cd2b598a2f6dabc12a6e90f299bdf2
SHA1 f5b650ea86f1948a3c0dc2233887b7cbe563ec7b
SHA512 cf71b7743975f9b811d354dc96997c84321b4122f1ba5ce3cb16169ac03291d7d7c96ef5ab832776b099b1d33f6401a5ea3c34363f9213f6917f9af8e1de30a6
SSDEEP 3072:X5ymLTDKzYeYlo3N9PnOukzdw1BmwxIae:JymbBeeo3N9vWd4Bmghe
TLSH
T12DC3E0D6D532FA9BD7381973FB6CCD447A81737603521FE987C00B52CB96AC49A8112B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3672	jpg.ÕæÑå^l.scr.exe
4148	jpg.ÕæÑå^l.scr.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3672 set thread context of 4148	3672	jpg.ÕæÑå^l.scr.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1556	4148	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Buzus.lbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jpg.ÕæÑå^l.scr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	jaffacakes118_Trojan.Win32.Buzus.lbq.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4536	mspaint.exe
4536	mspaint.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3672	jpg.ÕæÑå^l.scr.exe
4536	mspaint.exe
4536	mspaint.exe
4536	mspaint.exe
4536	mspaint.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3672	3424	jaffacakes118_Trojan.Win32.Buzus.lbq.exe	89
PID 3424 wrote to memory of 4536	3424	jaffacakes118_Trojan.Win32.Buzus.lbq.exe	90
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91
PID 3672 wrote to memory of 4148	3672	jpg.ÕæÑå^l.scr.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.lbq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.lbq.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\ jpg.ÕæÑå^l.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\ jpg.ÕæÑå^l.scr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\ jpg.ÕæÑå^l.scr.exe
    C:\Users\Admin\AppData\Local\Temp\ jpg.ÕæÑå^l.scr.exe
    3⤵
    - Executes dropped EXE
    PID:4148
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 28
      4⤵
      Program crash
      PID:1556
- C:\Windows\SysWOW64\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\.Very sweet..jpg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4148 -ip 4148
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.Very sweet..jpg

Path C:\Users\Admin\AppData\Local\Temp\.Very sweet..jpg
Size 6KB
SHA256 3dfd0a6276ebad295a0e3ab9df072c90a4c4ec9d0a83051d3e3b6fe77ad34ef1
MD5 a2ec3337be33375f6d79c7938ed2c110
SHA1 5b9d406a34f3f2e99a5ce7802b79a8d641ecf302
SHA512 6f34d0ddd6ebf1ffa9a0f7aea6880c9f6c0047b4b5ede8b422caccb3453680d4479d220b5fbcac3b31138437062f03c2a98118daf294894f64bb628a183a3300
SSDEEP 192:txuD4y2G/xiST5t0vQyH/Kz/TGEzaicT+If:tADb2VMH0RH/Kz/KEz9cR
TLSH
T148E18EA75B2E3413E4F0F2B512296579DE79EC037EB61A2AE6090F48E61765D0FF0904
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jpg.ÕæÑå^l.scr.exe

Path C:\Users\Admin\AppData\Local\Temp\ jpg.ÕæÑå^l.scr.exe
Size 107KB
SHA256 29533ae5a925d7185bdf5ecae6583a5cf2f29a57d9f1807e59cb1764d65b92ec
MD5 b340314765c92772ea13ea08387a60dd
SHA1 faf90b4785b2745da7b3050eabdbd247aabc8928
SHA512 c656db240cef4bd958474ec8c2325ce3c2b4fd79a2c0c4b771c0d09f831bb53d2176a5d7a1c9c004617c2c70b6a6e91f2591aba02245b41e7da942216898b1d9
SSDEEP 3072:AyiIF2SdaxNdiNCrWsto1b19UQbpah+HBJT:9iIFd8dm7q0b19/pxHBJT
TLSH
T14BB3F2636AA81972F6054BF7011D19FDB6633B213A121D420D0DF9A61EB79CA67F0E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-19-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-23-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-22-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-21-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-17-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-16-0x0000000010000000-0x0000000010010000-memory.dmp

Download

memory/4148-27-0x0000000000400000-0x0000000000403000-memory.dmp

Download