Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 18:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Inject.akujr.exe
Resource
win10v2004-20260911-en
16 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Inject.akujr.exe
- Size 581KB
- Sample261018-xep8matves
- SHA256 9ec7921602a50b0d98326ffa72471a9dfd588b9fcb4488e4aaf762a50fde8581
- MD5 8bc49770a1a0c976a9261ed25b0454cf
- SHA1 929e4928fd2fe5e296cf0627824773adc80fd9d3
- SHA512 4ca77f145b11b7174e7316d4fd91ae54aeeb1307bb679a05e6433247bacb1efaa9fb82b63c5a9e3299200ae8240cbf29fa1fe7f7a35ab8ff68be4a02b031a5a1
- SSDEEP 12288:RxQQU7Sb1L5rq0McS7KSUjLsY7bcsildpUwH/:nQQU7SqWo4LsY7bqMwH/
- TLSH T18FC44B0571A4FF6AD98DE4F03480C5BA95A6383736705D933EE6EA93D9112C3ACF9702
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 828 set thread context of 1236 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 90 PID 828 set thread context of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91 -
resource yara_rule behavioral2/memory/1236-6-0x0000000000400000-0x0000000000457000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Inject.akujr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 828 wrote to memory of 1236 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 90 PID 828 wrote to memory of 1236 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 90 PID 828 wrote to memory of 1236 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 90 PID 828 wrote to memory of 1236 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 90 PID 828 wrote to memory of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91 PID 828 wrote to memory of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91 PID 828 wrote to memory of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91 PID 828 wrote to memory of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91 PID 828 wrote to memory of 1392 828 jaffacakes118_Trojan.Win32.Inject.akujr.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.akujr.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.akujr.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.akujr.exe2⤵PID:1236
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.akujr.exe2⤵PID:1392
-