6589e6ecc3c2b1d7d97183f2e0e3af336a36b8ee9c76892b4793c1fee2405cc4

Analysis

max time kernel
149s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Size 5.0MB
Sample261018-vkctdagx21
SHA256 6589e6ecc3c2b1d7d97183f2e0e3af336a36b8ee9c76892b4793c1fee2405cc4
MD5 fb59bdce740ae1a216e2abd0c6fd9725
SHA1 080a0a5157db1ec0c73f6776411d9405b11d19c6
SHA512 dc86eeab58366de8081f6d49e696076f35076bacdd6d356ccbb18cce09b25a53f01b5fac54e04998a7b3013ee3a3d25936be68fe5b608c3db03e1a07d22d6775
SSDEEP 98304:JilUhOtek8YiLDyOocsY9ZLFvKwZE3lACOl4xqq6+w4OE:JSRekLihLgwZmlOVa3
TLSH
T1CB363350F04B8BFBD4631A30551406A0527CEBFEFBE12B66171A4B5D08F85CAED889E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5948	msisetup.exe
6072	msisetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5948 set thread context of 6072	5948	msisetup.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msisetup.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	jaffacakes118_Trojan.Win32.Inject.ldmh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5948	msisetup.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5948	msisetup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5948	msisetup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 5948	3288	jaffacakes118_Trojan.Win32.Inject.ldmh.exe	90
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91
PID 5948 wrote to memory of 6072	5948	msisetup.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ldmh.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ldmh.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
    3⤵
    - Executes dropped EXE
    PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msisetup.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
Size 15.2MB
SHA256 003c6c888d7602f05090e22b6dcec0a5aee907dfb9cec343b07f2e508a863072
MD5 ec5c63ab8675b8e9db02a123532943f8
SHA1 3fdea050eb10df68201191c83b8ca96cbfd45b20
SHA512 e794fe5f1db654e1064cdec0721d9e45e5bfa8c4aff224f2a16bfd4fdb73548db4a6fec140012975c6d471a91de45195dbfcd86a4bf5dea2645a989fd4ddd336
SSDEEP 393216:Z1pMhAip35695S7Qn3vUcQn3vUcQn3vU:8ldT7Q3McQ3McQ3M
TLSH
T103F6D113B3C8547AC06B1A3A9937AF64683FBB3039168D5B67F40D8C0F35941693A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3288-16-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3288-19-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5948-10-0x0000000000AB1000-0x0000000000AB3000-memory.dmp

Download

memory/5948-11-0x0000000000400000-0x0000000001343000-memory.dmp

Download

memory/5948-15-0x0000000000400000-0x0000000001343000-memory.dmp

Download

memory/6072-12-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads