Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Homepage.f.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Homepage.f.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Homepage.f.exe
- Size 32KB
- Sample261018-why49ssxhs
- SHA256 1939f415b3872d23eb8bfc591d37d82c28e26553f956b618b83f7230f5554850
- MD5 7ec4b0e72222b95deabc47b2744e2c95
- SHA1 9f76008ce6484e11c9aa8b48d50a0f23b0ac3cc1
- SHA512 6b60753b072e865f08981f92109f570c682d291257c731f796ab1658b85da98b94a7c3758050f48ec985356dc084f440369bd0ee50d3b00da983f1842415c5ca
- SSDEEP 384:zJgLGyteXNYIC9yFS2oosicZ80wt8V615bJJK0ha2u7+:e5ed9CUFS2RcZ80w8V85XKVO
- TLSH T1D4E2C507FA8ECDA2C62186345A6EAA78C13B5CA11F904BBBD744EF2C0C735D19B2615C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BACINE = "C:\\Windows\\firewall.exe" jaffacakes118_Trojan.Win32.Homepage.f.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\firewall.ini jaffacakes118_Trojan.Win32.Homepage.f.exe File opened for modification C:\Windows\jaffacakes118_Trojan.Win32.Homepage.f.INI jaffacakes118_Trojan.Win32.Homepage.f.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_Trojan.Win32.Homepage.f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_Trojan.Win32.Homepage.f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Homepage.f.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4220 jaffacakes118_Trojan.Win32.Homepage.f.exe 4220 jaffacakes118_Trojan.Win32.Homepage.f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Homepage.f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Homepage.f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\jaffacakes118_Trojan.Win32.Homepage.f.INI
- Size 40B
- SHA256 dfd67ac3ddcbca48392fddd31189384aaf4215316e5d56a4055e8d756f232471
- MD5 3c4756f8c148136c929f1f582f0686a4
- SHA1 673ecae1c1fc2b3347f3d41c3c6c51c593585dd4
- SHA512 4d921d38a057bee754c0680cdb79448b82e48da7367f03cc20f2ad7a752664952882622b83fad51f1e31d36bf816627c2f3edf8c52795a11ec5f56b3a3235549
- MD5 SHA1 SHA512