Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 10:16
Behavioral task
behavioral1
Sample
jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe
- Size 12KB
- Sample260919-maxf2aea93
- SHA256 6b6ba1de2aa54c6dccc40af5b0a358aa8c36fcac170c2b1b241c6ea297e5198f
- MD5 8c62e170efa4f76a53559aba0a422e87
- SHA1 1085c09bbaa8da6ff91cee80e085780b1de382a6
- SHA512 d8c3aee419258e48501ca126c7272fc40d54309fcad63835cf32f64dd23c3dd00927713a0f018aa6a5b2d0d23190cf5b960e99fb733f664d72872a45dc8f8399
- SSDEEP 192:nfMagrMsNhsxfwAMPN2OX2USVANIdFOZ+oCgCDUsEWRTO8R2fenOjPXlOxVLSLz1:kagl2wA8AOmVV5yZsDNEihhnOjPnD
- TLSH T1CD42BF8BF7AD4DEBC65B04BB33B3A5162319B59407F990E3A91E5364BDB809086C960C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4128-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4128-2-0x0000000000400000-0x0000000000410000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4128 jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8c62e170efa4f76a53559aba0a422e87.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:4128