629905dfeeec08c60be4a10d00d0bbd3bd9d3226b0edeb5340f0468f04135550

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Inject.uz.exe
Size 37KB
Sample261018-vr15jssthw
SHA256 629905dfeeec08c60be4a10d00d0bbd3bd9d3226b0edeb5340f0468f04135550
MD5 d7072b487e57e53a72d363ffe76e441a
SHA1 fa15ad93ee69550d788e92f6b9e4a1fbce53601c
SHA512 e6b65039afdb187224b2882953d82383b9a7ffb8c9d20e0571cfa601ecf11499d52a8be9e65e30c445e1d678e6d36bba2b2f443d48c63af0e5d890a26b8e691d
SSDEEP 768:N1uIb84HbpyYNo8opD7GogkstsF03lvS5xq8uIokKuTn0f3:iI8Cbpyp8opWo1sts15x3uIok7n0
TLSH
T16703F107E6350B45C3DD137FC6D7062AEBA86E78634A95101D9B44F02DC6BE80B6ADA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Drivers\usbinite.sys	binks.exe

Executes dropped EXE 1 IoCs

pid	Process
5460	binks.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	\??\c:\Program Files\binks.exe	jaffacakes118_Trojan.Win32.Inject.uz.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.uz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	binks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5380	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5460	binks.exe
5460	binks.exe
5460	binks.exe
5460	binks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5460	binks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 5460	2928	jaffacakes118_Trojan.Win32.Inject.uz.exe	89
PID 5460 wrote to memory of 944	5460	binks.exe	8
PID 5460 wrote to memory of 944	5460	binks.exe	8
PID 2928 wrote to memory of 3852	2928	jaffacakes118_Trojan.Win32.Inject.uz.exe	90

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:944

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.uz.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.uz.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- \??\c:\Program Files\binks.exe
  "c:\Program Files\binks.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\Deleteme.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:5096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:5380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

binks.exe

Path C:\Program Files\binks.exe
Size 27KB
SHA256 1f1fcfa487e6f3a91709e51718a2d204478994762164e7f70f0c94f8d4e0e51a
MD5 2aff49722b70b52681c505af6bbc1ffd
SHA1 fc02c5c3229894f7801f0abec79d56ce9aad5fbc
SHA512 6f0700b70cf5fbc38de0a439d66c17e6f9a7a4478dd4c2e8e9310378c0f15690e877511e157cdad4800d04204a8ad12ad12de2eaeb308f2ac1f02950cfddf628
SSDEEP 384:oWnCrWFKnhkteTl5KCK4V66cQuGhIWXadf6fPflwJIRQfpIZ2hG2igb7YGuslHZr:QOKnhRFzxIWX/RQxIYhGB07YGug5dMY
TLSH
T1AAD2F10AB5F3567FD0561B34D2A78E0412AFFBE67735081196029402726E660BC3FB9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Deleteme.bat

Path \??\c:\Deleteme.bat
Size 192B
SHA256 d704056623b689579fa485d681418f993cc3c44421774dff4633d18c5664c252
MD5 1ded45b2660edf7d35eac53f4c74791c
SHA1 3a57f367dd12499f6d3f5eb567b6c02667aaef9d
SHA512 bf51ee59730ac9884afa8edf550b3260ae4af00012351935486cdbbc038eb44d8b6d929c8fe477cf3bc9acec4b50985bca70fbcea0aaffcadb0c9abc58a67792
TLSH
T1A2C0128181D2C5594880D87F06785A8DE6590A5926883F3D8B62C1D851B101AB7C3B45
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2928-0-0x0000000000400000-0x0000000000425000-memory.dmp

Download

memory/2928-10-0x0000000000400000-0x0000000000425000-memory.dmp

Download