Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 10:46
General
- Target jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe
- Size 285KB
- Sample260919-mt8cmsec52
- SHA256 425de8503ab0dfdfc97acec9fab2d95c799f9f3f722f01eb68c6bfa5f29daedc
Malware Config
Signatures
- ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 24 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8dda6ac0049d5a3dab35fa0c28186045.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\Cursors\OLE2APPL.EXE"C:\WINDOWS\Cursors\OLE2APPL.EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 15163⤵
- Program crash
-
-
-
C:\WINDOWS\Cursors\OLE2APPL.exeC:\WINDOWS\Cursors\OLE2APPL.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 14962⤵
- Program crash
-
-
C:\WINDOWS\Cursors\OLE2APPL.exeC:\WINDOWS\Cursors\OLE2APPL.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 14322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5072 -ip 50721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4608 -ip 46081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4700 -ip 47001⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MINUTAEA8537EFSEQ0.BCK
MINUTAEA8537EFSEQ0.BCK
MINUTAEA8537EFSEQ0.BCK
ole2comm.dll
ole32bits.txt
ole32bits.txt
OLE2APPL.exe
ole2kbda.txt
ole2moua.txt
memory/2580-37-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2580-0-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4608-53-0x0000000000400000-0x0000000000498000-memory.dmp
memory/4608-73-0x0000000000A50000-0x0000000000A5E000-memory.dmp
memory/4608-72-0x0000000000400000-0x0000000000498000-memory.dmp
memory/4608-27-0x0000000002380000-0x0000000002381000-memory.dmp
memory/4608-55-0x0000000002380000-0x0000000002381000-memory.dmp
memory/4608-54-0x0000000000A50000-0x0000000000A5E000-memory.dmp
memory/4700-74-0x0000000000400000-0x0000000000498000-memory.dmp
memory/4700-56-0x0000000000400000-0x0000000000498000-memory.dmp
memory/4700-57-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/4700-58-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4700-41-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/4700-77-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/5072-52-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/5072-18-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/5072-51-0x0000000000400000-0x0000000000498000-memory.dmp
memory/5072-50-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/5072-76-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/5072-75-0x0000000000400000-0x0000000000498000-memory.dmp