ae31b216db8ee10ce697dda9008bcfb0ba0d4bc813d8cb97d75ae026bd61400b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.lhka.exe
Size 4.8MB
Sample261018-vmvf7szz8j
SHA256 ae31b216db8ee10ce697dda9008bcfb0ba0d4bc813d8cb97d75ae026bd61400b
MD5 e0e5b673ab0d84a2291a0eab986fa394
SHA1 16f69e78c0f7a3c56de84e62cd5510b30d21d5bc
SHA512 af05963eb53e1b4e80b43c98dff0307399022b08d5d6a17a1c5a5dc4bba38f3a683e6c4e2f2eee0fa09b8fcc5fd90f7c0518424e069c039da86a7607915c43cb
SSDEEP 98304:j2J/Fd+usR8uwf/yyGmtgjQOGZhbfJxs4Tj01Clp9ScuTwj9L92JFs+:j2JvOeHf2jofvbTj0gXScuTwj9ByFs+
TLSH
T15136337AF68F52F1D8822130D7745F7AA0787E93C8A4674B6BCCBD057E61146610BC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1244	msisetup.exe
3200	msisetup.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 3200	1244	msisetup.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msisetup.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	jaffacakes118_Trojan.Win32.Inject.lhka.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1244	msisetup.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 1244	5412	jaffacakes118_Trojan.Win32.Inject.lhka.exe	89
PID 1244 wrote to memory of 4284	1244	msisetup.exe	90
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92
PID 1244 wrote to memory of 3200	1244	msisetup.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.lhka.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.lhka.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:4284
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe"
    3⤵
    - Executes dropped EXE
    PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msisetup.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msisetup.exe
Size 13.7MB
SHA256 2b18711638f49c468502ba84c081a9cdfec447fd3ec996fc6b14729cfff88821
MD5 9420c65272a730bb7e06cd05616f6a39
SHA1 f075375c353ea972ce8098bd4f64034ef5ed1309
SHA512 004a9d2946ab59ce9541c48cef2c4715c9272a6422adc780796bd1e1236cd1feb66785eb41022a25eb02b563411622f068678cfc2b726da1d7a22b5fe168de80
SSDEEP 196608:WfMczd/tDCGT+Gc4sSaqhlIecuM1xCalIecuM1xCalIecuM1xC:WfMed/tDCGaQs6QTCTCT
TLSH
T1EEE6E116B344243FD0AB2B39983BAA54A93FBA2139D68C5A77F40DCC4F39541293B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-10-0x0000000000971000-0x0000000000973000-memory.dmp

Download

memory/1244-11-0x0000000000400000-0x00000000011C6000-memory.dmp

Download

memory/1244-17-0x0000000000400000-0x00000000011C6000-memory.dmp

Download

memory/3200-14-0x0000000000400000-0x0000000000CAF000-memory.dmp

Download

memory/5412-15-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5412-20-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads