ad03bc735021540f47db950e92aa8ba5502e2b0316326b63ac0d04788980b2a1

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
Size 32KB
Sample260919-flleksbe49
SHA256 ad03bc735021540f47db950e92aa8ba5502e2b0316326b63ac0d04788980b2a1
MD5 6a5adcef2a94cdf8cc453f15b3f282d1
SHA1 68228f768d8cc6df3095715d65206efbf11e6af5
SHA512 dcfdb08be025d33cb164a06e2624894d658cce065681aeedfff61ded8a9d8ea1972bf7e904c8ef36f10600d6d150debb894b494066557edb272df650f0f79144
SSDEEP 384:RNJU2SAmx/FPy4ivenJ1P9a0Jr7nyeX56QifezVSmg:fJ7STvSgNDHyg56QifIlg
TLSH
T188E28E4E69A3647BF0038D76C7EA45DA5FFD6C573A63292FCB00610628F0294D491BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe"	regedit.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3468 set thread context of 5056	3468	WinHttp.exe	91
PID 2776 set thread context of 2312	2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	96

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\a.bat	WinHttp.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe
5236	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2404	5056	WerFault.exe	91
1856	2312	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHttp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2064	regedit.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2064	2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	88
PID 3468 wrote to memory of 5056	3468	WinHttp.exe	91
PID 3468 wrote to memory of 5056	3468	WinHttp.exe	91
PID 3468 wrote to memory of 3900	3468	WinHttp.exe	93
PID 2776 wrote to memory of 2312	2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	96
PID 2776 wrote to memory of 2312	2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	96
PID 2776 wrote to memory of 5236	2776	jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6a5adcef2a94cdf8cc453f15b3f282d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:2064
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 16
    3⤵
    - Program crash
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5236

C:\Users\Admin\AppData\Local\WinHttp.exe
C:\Users\Admin\AppData\Local\WinHttp.exe
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 16
    3⤵
    - Program crash
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 236 -p 5056 -ip 5056
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2312 -ip 2312
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX69CC.tmp

Path C:\Users\Admin\AppData\Local\RCX69CC.tmp
Size 32KB
SHA256 aa64348b052add2022c80782a4aed7218cb92d78eafc17b114c12ca87320a086
MD5 1e4ba658ac381ec6113af9b9d201dcbd
SHA1 402796a0851ea533c2bb36fc494dbf59daace0f5
SHA512 c3b2e3f922b36d0cfc6a095a10d10586bf54463c90437226e53731e7908eb2b82c56c9d4d654f9a5f9b0986c3d55ac6f2a65be89a0210f43990afada6fe67844
SSDEEP 384:R8/ODKUqx/FPy4ivenb1PgJ1dv1YFzBJtJuiPRr7pd2GlE5Qfzg:a1vSgSr51YFtnJpdHfrg
TLSH
T17DE27D1E6EDB00A7F1D3DD35C3D816EA9BFD6C573D65682FCF90160128A0198D8A1BB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~dfds3.reg

Path C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
Size 166B
SHA256 767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
MD5 f44153ef26be29552cf320325ad8b72e
SHA1 74ac72ba2ff0f871e59b11c95ad707372662370c
SHA512 1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
TLSH
T100C08051D811B331F9D0B50446155992E7F3435D3DEB5740404495C569D128EC23D0F7
MD5 SHA1 SHA512 TLSH

Submit Download

WinHttp.exe.tmp1

Path C:\Users\Admin\AppData\Local\WinHttp.exe.tmp1
Size 32KB
SHA256 8fdfed63df551cd02c66b79dc7e9f40916829b500a0ecbf05d4f6291e8e89b88
MD5 d53d54e7c5ce97ea90e9c03de8dcfbb8
SHA1 d88c5e3f6d7435e476afdfafea2866794e2af6a7
SHA512 6e2b52d793cbb1bf186c1233018d4ccd548c7f9d270251975ae445d7dcf7a2d159337a202a9c63ff2d3b7cdcf3d0d3b1f746cc053142e2b0a2ef44b44c24b182
SSDEEP 384:R8/ODKUqx/FPy4ivenb1P9a0Jr7nyeX56QifezVSmg:a1vSgXDHyg56QifIlg
TLSH
T1CAE27D0E5DA7546BF0138D36C7EA55DA5FFCAC573AA2752FCB40510228B02E8C092BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHttp.exe.tmp1

Path C:\Users\Admin\AppData\Local\WinHttp.exe.tmp1
Size 32KB
SHA256 2ae07c953bce1fb7e359bee253903e4f3ba715a2105957198bacc7036643657a
MD5 886e077773cff411a16d4b382e9a5f26
SHA1 8f01ed6243deb77ecb6d0e91ec5019523772bc81
SHA512 ff9b9b86f56d5ed7d8f78dcb671e81c3dc2fc392a276a6ea83917661b2adc4e3552c2c362000b0749bdfdcf96416ecb088d220d70d5fe3e869a9d79ac91bfd8b
SSDEEP 384:RamqUTfx/FPy4ivenn1P9a0Jr7nyeX56QifezVSmg:cEvSgLDHyg56QifIlg
TLSH
T1AAE28E0E59A72477F0128D36C7FA51EA4FFCAC573A62792FCB40514628B42D8C491BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.bat

Path C:\Windows\a.bat
Size 1024B
SHA256 403434524aa643d010abde67414dcfadd33773e374d193a663a45b68528af06f
MD5 2d10dd235c538ea1b019ae05e89d812c
SHA1 815a72042573a992935c75f159b0fa291ccc49a0
SHA512 0cbf14c0f8590ec20db30760cce6f61dcc1ffd53ab67d86c48f8daea484aaff341bf77ea50a99f2b577933db4901d820f5c0925df85f808492bac6d0ab10333d
TLSH
T16511021284D68B69CC08E83B4EB6A18DC0B618993E993A406611889E629240DF8DB602
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2776-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2776-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3468-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5056-3-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads