6589e6ecc3c2b1d7d97183f2e0e3af336a36b8ee9c76892b4793c1fee2405cc4

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Size 5.0MB
Sample261018-vkctdagx21
SHA256 6589e6ecc3c2b1d7d97183f2e0e3af336a36b8ee9c76892b4793c1fee2405cc4
MD5 fb59bdce740ae1a216e2abd0c6fd9725
SHA1 080a0a5157db1ec0c73f6776411d9405b11d19c6
SHA512 dc86eeab58366de8081f6d49e696076f35076bacdd6d356ccbb18cce09b25a53f01b5fac54e04998a7b3013ee3a3d25936be68fe5b608c3db03e1a07d22d6775
SSDEEP 98304:JilUhOtek8YiLDyOocsY9ZLFvKwZE3lACOl4xqq6+w4OE:JSRekLihLgwZmlOVa3
TLSH
T1CB363350F04B8BFBD4631A30551406A0527CEBFEFBE12B66171A4B5D08F85CAED889E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan.Win32.Inject.ldmh.exe

Executes dropped EXE 2 IoCs

pid	Process
5768	msisetup.exe
2876	msisetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5768 set thread context of 2876	5768	msisetup.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	msisetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	msisetup.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msisetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msisetup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2876	msisetup.exe
2876	msisetup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5768	msisetup.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5768	msisetup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5768	msisetup.exe
2876	msisetup.exe
2876	msisetup.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 5768	4172	jaffacakes118_Trojan.Win32.Inject.ldmh.exe	84
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 5768 wrote to memory of 2876	5768	msisetup.exe	88
PID 2876 wrote to memory of 3536	2876	msisetup.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ldmh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ldmh.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msisetup.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
Size 15.2MB
SHA256 003c6c888d7602f05090e22b6dcec0a5aee907dfb9cec343b07f2e508a863072
MD5 ec5c63ab8675b8e9db02a123532943f8
SHA1 3fdea050eb10df68201191c83b8ca96cbfd45b20
SHA512 e794fe5f1db654e1064cdec0721d9e45e5bfa8c4aff224f2a16bfd4fdb73548db4a6fec140012975c6d471a91de45195dbfcd86a4bf5dea2645a989fd4ddd336
SSDEEP 393216:Z1pMhAip35695S7Qn3vUcQn3vUcQn3vU:8ldT7Q3McQ3McQ3M
TLSH
T103F6D113B3C8547AC06B1A3A9937AF64683FBB3039168D5B67F40D8C0F35941693A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2876-27-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-24-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-14-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-17-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-16-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-18-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-20-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-34-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-33-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-25-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-32-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-23-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-31-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-26-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-30-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-28-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/2876-29-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/4172-22-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4172-21-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5768-12-0x0000000000AB1000-0x0000000000AB3000-memory.dmp

Download

memory/5768-13-0x0000000000400000-0x0000000001343000-memory.dmp

Download

memory/5768-19-0x0000000000400000-0x0000000001343000-memory.dmp

Download