Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
19/09/2026, 10:46
General
- Target jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe
- Size 285KB
- Sample260919-mt8cmsec52
- SHA256 425de8503ab0dfdfc97acec9fab2d95c799f9f3f722f01eb68c6bfa5f29daedc
Malware Config
Signatures
- ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\Cursors\OLE2APPL.EXE"C:\WINDOWS\Cursors\OLE2APPL.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 14363⤵
- Program crash
-
-
-
C:\WINDOWS\Cursors\OLE2APPL.exeC:\WINDOWS\Cursors\OLE2APPL.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 14562⤵
- Program crash
-
-
C:\WINDOWS\Cursors\OLE2APPL.exeC:\WINDOWS\Cursors\OLE2APPL.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 14922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 976 -ip 9761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2804 -ip 28041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5108 -ip 51081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MINUTAEC2E75CASEQ0.BCK
MINUTAEC2E75CASEQ0.BCK
MINUTAEC2E75CASEQ0.BCK
ole2comm.dll
ole32bits.txt
ole32bits.txt
OLE2APPL.exe
ole2kbdb.txt
ole2moua.txt
memory/976-70-0x0000000000610000-0x000000000061E000-memory.dmp
memory/976-17-0x0000000002240000-0x0000000002241000-memory.dmp
memory/976-69-0x0000000000400000-0x0000000000498000-memory.dmp
memory/976-49-0x0000000002240000-0x0000000002241000-memory.dmp
memory/976-51-0x0000000000610000-0x000000000061E000-memory.dmp
memory/976-50-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-53-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/2804-101-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-52-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-117-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-113-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-109-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-26-0x0000000000750000-0x0000000000751000-memory.dmp
memory/2804-54-0x0000000000750000-0x0000000000751000-memory.dmp
memory/2804-85-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-93-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-73-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-74-0x00000000005A0000-0x00000000005AE000-memory.dmp
memory/2804-105-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-89-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-77-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-97-0x0000000000400000-0x0000000000498000-memory.dmp
memory/2804-81-0x0000000000400000-0x0000000000498000-memory.dmp
memory/4536-0-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4536-28-0x0000000000400000-0x0000000000420000-memory.dmp
memory/5108-79-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-87-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-91-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-83-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-95-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-32-0x0000000002100000-0x0000000002101000-memory.dmp
memory/5108-99-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-76-0x00000000007B0000-0x00000000007BE000-memory.dmp
memory/5108-103-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-107-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-75-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-57-0x0000000002100000-0x0000000002101000-memory.dmp
memory/5108-111-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-55-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-115-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5108-56-0x00000000007B0000-0x00000000007BE000-memory.dmp
memory/5108-119-0x0000000000400000-0x0000000000498000-memory.dmp