Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 19:52
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Delf.gk.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Delf.gk.exe
- Size 33KB
- Sample261018-ylldpatzhw
- SHA256 b0eeaf24d98cc9a1bb20c27d081cff32d520f16c920e87cedc5912fe8c400233
- MD5 bbc73e4384f281e259766fb33e629f99
- SHA1 381ec550034323d8712891377b7225ac78d41c80
- SHA512 6e531cfa9c9768c513aafb0cb7568bee5188526a6356b298476b4d1201c4d846474e47eb4c53a27281e61d299d9feb5856c89dc0958cfdebdd49ad335be94452
- SSDEEP 768:r5Gsq/XQGcoGVzUDWbcvZOkglUWJY3ggxfha5kb:r5GD/XPgQGcvZORS3g+
- TLSH T18DF2E113BA79CCE7DAC6307634DB0D89E9B28EB25374484331B602BD6D2D814DC6E99C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/files/0x000200000001b2f6-4.dat aspack_v212_v242 - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: jaffacakes118_Trojan.Win32.Delf.gk.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\libpng.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\excelcnv.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jjs.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\java.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\asm.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ktab.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\giflib.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\ktab.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmiregistry.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\rmid.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxml2.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\servertool.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\javafx\directshow.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jdeps.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\rmid.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\idlj.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\legal\jdk\dom.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\legal\jdk\icu.md jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\native2ascii.exe jaffacakes118_Trojan.Win32.Delf.gk.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md jaffacakes118_Trojan.Win32.Delf.gk.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Delf.gk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4248 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 90 PID 4308 wrote to memory of 2724 4308 jaffacakes118_Trojan.Win32.Delf.gk.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\SysWOW64\at.exeat 1 /delete /yes2⤵
- System Location Discovery: System Language Discovery
PID:4248
-
-
C:\Windows\SysWOW64\at.exeat 8:57:29 PM "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.gk.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2724
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 67KB
- SHA256 53a1ef8b6ea57fe30a2635e87a41aec10f8a95997c3298eace7f1dd5c2175fce
- MD5 7018825e69d475671bf7cdfe87ff863d
- SHA1 ec2ed9eb104cf47038549bb0ae2201b1ee04ba80
- SHA512 8416b81317d770bc482169dd5734759b26b2ab9ba861bbe3b034c046a3edbe7ed6f10d64bb6242be7cf59fb7a4f55c291b16153dff54014917f4846caafb746d
- SSDEEP 1536:r5GD/XPgQGcvZORS3g+yh5D2YaqokOjB4s+qJd:r5GzISZs7DCtfk0+qJd
- TLSH T14863A0579254C17DE4A2907AD5C6DA0AE9313558A331CCCBB3630B297E175E03E3FB68
- MD5 SHA1 SHA512 SSDEEP TLSH