f16eea0c66a7d44ccba8e4bf95bb4c38fa2149146426ba9d78031397a6b8e355

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.ggz.exe
Size 132KB
Sample261018-t415msgv81
SHA256 f16eea0c66a7d44ccba8e4bf95bb4c38fa2149146426ba9d78031397a6b8e355
MD5 5061dec2554a7d503ee5976005408937
SHA1 e45da958a34f6d1dbc2ef64fb0b2e8d78f68c29b
SHA512 1c119a23ad7fd44ab0450c88d7402e879e203e89addde91bc705a749977deffee5c544d513de1ca5ba6460c6a8044d04a7b75a9c35afdaf9c4c739c491bdac0f
SSDEEP 3072:DD6H+y20JlLgjfNQ4bcjTwT994Th6rC2dY2heTwti2gZ:DDn0JQfNQ4bc3wT994Th6rC2duT/n
TLSH
T130D3A3013CA6C471F9975238C547C4B7223A689B78A68E3B5FDD093E0B520BC965F7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "2"	svchost.exe

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "2"	svchost.exe

Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	jaffacakes118_Trojan.Win32.Inject.ggz.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
4876	svchost.exe
3792	OfficeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SoundMax = "C:\\Users\\Admin\\userinit.exe"	svchost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\D:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	svchost.exe
File created	F:\Autorun.inf	svchost.exe
File opened for modification	F:\Autorun.inf	svchost.exe
File created	C:\Autorun.inf	svchost.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSshare.exe	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Web\OfficeUpdate.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ggz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OfficeUpdate.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 4876	1264	jaffacakes118_Trojan.Win32.Inject.ggz.exe	88
PID 4876 wrote to memory of 848	4876	svchost.exe	89
PID 4876 wrote to memory of 2360	4876	svchost.exe	91
PID 4876 wrote to memory of 6108	4876	svchost.exe	93

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Nofolderoptions = "1"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ggz.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ggz.exe"
1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visibility of hidden/system files in Explorer
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4876
- - C:\Windows\SysWOW64\at.exe
    "C:\Windows\System32\at.exe" /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
- - C:\Windows\SysWOW64\at.exe
    "C:\Windows\System32\at.exe" 20:30 /every:M,T,W,TH,F,S,SU C:\Windows\Web\OfficeUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
- - C:\Windows\SysWOW64\at.exe
    "C:\Windows\System32\at.exe" 11:30 /every:M,T,W,TH,F,S,SU C:\Windows\Web\OfficeUpdate.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108

C:\Windows\Web\OfficeUpdate.exe
C:\Windows\Web\OFFICE~1.EXE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 132KB
SHA256 f16eea0c66a7d44ccba8e4bf95bb4c38fa2149146426ba9d78031397a6b8e355
MD5 5061dec2554a7d503ee5976005408937
SHA1 e45da958a34f6d1dbc2ef64fb0b2e8d78f68c29b
SHA512 1c119a23ad7fd44ab0450c88d7402e879e203e89addde91bc705a749977deffee5c544d513de1ca5ba6460c6a8044d04a7b75a9c35afdaf9c4c739c491bdac0f
SSDEEP 3072:DD6H+y20JlLgjfNQ4bcjTwT994Th6rC2dY2heTwti2gZ:DDn0JQfNQ4bc3wT994Th6rC2duT/n
TLSH
T130D3A3013CA6C471F9975238C547C4B7223A689B78A68E3B5FDD093E0B520BC965F7B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autorun.inf

Path F:\Autorun.inf
Size 301B
SHA256 dd73a4bde063cff2e9cb54fb3ae9c6fcd1258f09b0748702b889dd498a074c79
MD5 6bb6511e595902b50fd76ca4e85dc1a3
SHA1 3b3cff350b98aa2f1813505cb8106a0239b1e405
SHA512 d780fcde4264cf85458f55366f6cd92e6f41643c1ec2279b86fa210f136f937e9948e0f6a059c32cd4581cca69f2f49bd48d5d5474a5b9188bbc628871d5a0b5
TLSH
T102E0ECA3F45EA24F4E1E3115D3C1006A74CAE289C92841AA935DD8C919B565E8E416F4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1264-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/1264-1-0x000000000040F000-0x0000000000410000-memory.dmp

Download

memory/1264-3-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3792-11-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/3792-12-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4876-4-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/4876-15-0x0000000000400000-0x0000000000425000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads