Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Hooker.fa.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Hooker.fa.exe
- Size 829KB
- Sample261018-wh5xtaca59
- SHA256 fa91b2a024b3ba8f276745d8a1d944a55f2383f4a20e65117120c071315ce631
- MD5 0586b305849eb4f999370a19cd84b1f0
- SHA1 8371c7d4824f80ff7a673952bd1ec4acb7c5b8a0
- SHA512 38fe1920e484d8dd14c15bd740013a53047d3cab12fedaa9473ba7a59821cbd96ab9ab754c023c78555119f78354471ca881e4f3e1bcf21e46d595c58ddfca85
- SSDEEP 6144:MQxcSCFyfvIIsgAxk7bDp5DHRYleaR5l1z3nf2GY49ucCEM7zGdn1FMsm5npvD:MQKyfvBDvjKeaR5Dr2P4ccCECzGV16dD
- TLSH T1B4055A017750C076D75A17358446EB716AB9AD312BA2C6CBF7A47E3A5E302C29E3730E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\clk.ini jaffacakes118_Trojan.Win32.Hooker.fa.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\OyEX.dll jaffacakes118_Trojan.Win32.Hooker.fa.exe File created C:\Windows\run.bat jaffacakes118_Trojan.Win32.Hooker.fa.exe File created C:\Windows\sDjz.dll jaffacakes118_Trojan.Win32.Hooker.fa.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1260 cmd.exe 4676 cmd.exe 6060 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Hooker.fa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} jaffacakes118_Trojan.Win32.Hooker.fa.exe Key created \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118_Trojan.Win32.Hooker.fa.exe Set value (int) \REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0" jaffacakes118_Trojan.Win32.Hooker.fa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSIONS\{2670000A-7350-4F3C-8081-5663EE0C6C49} jaffacakes118_Trojan.Win32.Hooker.fa.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: SeIncBasePriorityPrivilege 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe Token: 33 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3900 wrote to memory of 1260 3900 jaffacakes118_Trojan.Win32.Hooker.fa.exe 90 PID 1260 wrote to memory of 4676 1260 cmd.exe 92 PID 1260 wrote to memory of 6060 1260 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hooker.fa.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hooker.fa.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\run.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\Local Settings\Application Data\Mozilla\Firefox\Profiles\*.default" /B3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4676
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\*.default" /B3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:6060
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\OyEX.dll
- Size 337KB
- SHA256 c5c710afe0344cf17b3689eb999c0758375ab8c05c66b92955958949db87da1a
- MD5 ec304a83d73b3bea88be2d3409572c10
- SHA1 aab5f62a900d5e47d3a28adab82cd377db842fac
- SHA512 aab0e2f7e46d2069c66eb8fd89415ce8848e2b99bca0720bef591f388ef22fcd672d2a17d2a7ba1991c2d2c6954bd5da631a20611d27392173dc09eaedb52a27
- SSDEEP 3072:ZDpbidIpcWN3nc/c0ybINjEbY79FGQanP9EWD56BiMidi:LY49ucCEM7zGdn1FMs
- TLSH T1FA744A8567A0C2BEE4991739D4435F317FB9BA333B7386A727948F260D207869D3170A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\clk.ini
- Size 26B
- SHA256 c4231a8f59c8acf36d244c86c2378dfc9dad719441ebe43a88c18ea0408eeb63
- MD5 45505e4976a2fd62b324e73850c58ab0
- SHA1 2fccc3b3104def2d563f381995620efacad5b388
- SHA512 d15abd9df2076f8d857023c1caed0fb8cbb9e06df10ce759a81660bc5e22b55fc520fec8caf390021812e6a8207a684d681bbd58433381e703f8e8e930025b52
- MD5 SHA1 SHA512
- Path C:\Windows\run.bat
- Size 5KB
- SHA256 62c2f28a0d7d2fc48b0b9465606aeba7f67d6532b427822f0e1b25a5651fbc14
- MD5 21ca1eda5c78f806288e07e4c5849d4e
- SHA1 766f9e1501e7a017c48b78575be2e6c4d2d92024
- SHA512 fc42f1c13c3ae274f3840d8aa3bbb04488a115e4b93dd028442884f80ea8520be652719f6f8addcfdb9230e005b54ac463bd1dbd6c4ab9968f7398624465ab8f
- SSDEEP 48:6eE6Q9Q2uQu0Eo2ONoEZDLEZDf9ZD5ZDXZDJZDxZDfZDRZD9EZDX2ZDhZDUZDKoY:NY/LuD/lPHdn9u43+LKrpT
- TLSH T179B166C3B64E126351CB3A98A2CEA9466E35008D37905FD01291E9FC728F4E5F2D67E7
- MD5 SHA1 SHA512 SSDEEP TLSH