Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
18/10/2026, 15:24
General
- Target jaffacakes118_Trojan.Win32.Refroso.fxhs.exe
- Size 383KB
- Sample261018-sthd4set9j
- SHA256 ade5681f3983e3ea3ee5206853a0c59d60438acff24eba4b83c7e8c82e7b4596
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.fxhs.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.fxhs.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.fxhs.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Refroso.fxhs.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/512-0-0x0000000000400000-0x0000000000504000-memory.dmp
memory/512-1-0x0000000002AC0000-0x0000000002AC4000-memory.dmp
memory/512-2-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-16-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-15-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-27-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/512-26-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/512-25-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-24-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-23-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-22-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-21-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-20-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-19-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-18-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-17-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-14-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-13-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-12-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-11-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-10-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-9-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-8-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-7-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-6-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-5-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-4-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-3-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-30-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/512-51-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/512-50-0x0000000002D10000-0x0000000002D11000-memory.dmp
memory/512-49-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/512-48-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/512-47-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/512-46-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/512-45-0x0000000002B90000-0x0000000002B91000-memory.dmp
memory/512-44-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/512-43-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/512-42-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/512-41-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/512-40-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/512-39-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/512-38-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/512-37-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/512-36-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/512-35-0x0000000002900000-0x0000000002901000-memory.dmp
memory/512-34-0x0000000002940000-0x0000000002941000-memory.dmp
memory/512-33-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/512-32-0x0000000002130000-0x0000000002131000-memory.dmp
memory/512-31-0x0000000002120000-0x0000000002121000-memory.dmp
memory/512-56-0x0000000000400000-0x0000000000504000-memory.dmp
memory/5116-52-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5116-53-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5116-54-0x0000000000400000-0x0000000000408960-memory.dmp
memory/5116-57-0x0000000000400000-0x0000000000409000-memory.dmp