Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 19:52
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Delf.gk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Delf.gk.exe
- Size 33KB
- Sample261018-ylldpatzhw
- SHA256 b0eeaf24d98cc9a1bb20c27d081cff32d520f16c920e87cedc5912fe8c400233
- MD5 bbc73e4384f281e259766fb33e629f99
- SHA1 381ec550034323d8712891377b7225ac78d41c80
- SHA512 6e531cfa9c9768c513aafb0cb7568bee5188526a6356b298476b4d1201c4d846474e47eb4c53a27281e61d299d9feb5856c89dc0958cfdebdd49ad335be94452
- SSDEEP 768:r5Gsq/XQGcoGVzUDWbcvZOkglUWJY3ggxfha5kb:r5GD/XPgQGcvZORS3g+
- TLSH T18DF2E113BA79CCE7DAC6307634DB0D89E9B28EB25374484331B602BD6D2D814DC6E99C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0002000000022bf0-6.dat aspack_v212_v242 - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: jaffacakes118_Trojan.Win32.Delf.gk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\mip.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\xjc.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javah.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\java-rmi.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jmap.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\unpack200.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\public_suffix.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmid.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jhat.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\keytool.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\libxml2.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\xalan.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jcmd.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jjs.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\klist.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\appletviewer.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\klist.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\extcheck.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\idlj.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\policytool.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\schemagen.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Internet Explorer\ExtExport.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jrunscript.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md jaffacakes118_Trojan.Win32.Delf.gk.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Delf.gk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2968 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 85 PID 4804 wrote to memory of 2952 4804 jaffacakes118_Trojan.Win32.Delf.gk.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\at.exeat 1 /delete /yes2⤵
- System Location Discovery: System Language Discovery
PID:2968
-
-
C:\Windows\SysWOW64\at.exeat 8:57:28 PM "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2952
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 67KB
- SHA256 53a1ef8b6ea57fe30a2635e87a41aec10f8a95997c3298eace7f1dd5c2175fce
- MD5 7018825e69d475671bf7cdfe87ff863d
- SHA1 ec2ed9eb104cf47038549bb0ae2201b1ee04ba80
- SHA512 8416b81317d770bc482169dd5734759b26b2ab9ba861bbe3b034c046a3edbe7ed6f10d64bb6242be7cf59fb7a4f55c291b16153dff54014917f4846caafb746d
- SSDEEP 1536:r5GD/XPgQGcvZORS3g+yh5D2YaqokOjB4s+qJd:r5GzISZs7DCtfk0+qJd
- TLSH T14863A0579254C17DE4A2907AD5C6DA0AE9313558A331CCCBB3630B297E175E03E3FB68
- MD5 SHA1 SHA512 SSDEEP TLSH