0ccf250774592f74c1a719306f800a58ffc163b6fbc915bb81c4c61064a98569

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Size 139KB
Sample260919-ntcfmseh25
SHA256 0ccf250774592f74c1a719306f800a58ffc163b6fbc915bb81c4c61064a98569
MD5 908bc43930527ab4eb1c0dfac9e7d123
SHA1 6a44a6261e304fe0d5b9d09ef324d537974de97d
SHA512 840267cf6bcccdbaa561f024cd54874e67e3eb440126844e26d0df05f45ee2fb8e6039d6a71757c92e893f2395fc836a01f1f54a8ebab603f5f0d1e0de9a26e6
SSDEEP 3072:zH+Mcv5JXXieDEvy1W7rkD+bnAIhRjaNA:zHl0ndEqgkCAaRGO
TLSH
T16EE38E729541E8B3C24601726112A76F1EA9AF371778ECAFC7505AD93EF82E2D230357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 14 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Wmi\Parameters\ServiceDll = "C:\\Windows\\system32\\Wmi.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmdmPmSp\Parameters\ServiceDll = "C:\\Windows\\system32\\WmdmPmSp.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\PCAudit\Parameters\ServiceDll = "C:\\Windows\\system32\\PCAudit.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SRService\Parameters\ServiceDll = "C:\\Windows\\system32\\SRService.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LogonHours\Parameters\ServiceDll = "C:\\Windows\\system32\\LogonHours.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\helpsvc\Parameters\ServiceDll = "C:\\Windows\\system32\\helpsvc.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uploadmgr\Parameters\ServiceDll = "C:\\Windows\\system32\\uploadmgr.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll"	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe

Loads dropped DLL 17 IoCs

pid	Process
2800	svchost.exe
1096	svchost.exe
1096	svchost.exe
4608	svchost.exe
2140	svchost.exe
5864	svchost.exe
764	svchost.exe
764	svchost.exe
236	svchost.exe
236	svchost.exe
5380	svchost.exe
4448	svchost.exe
4448	svchost.exe
2700	svchost.exe
2904	svchost.exe
1036	svchost.exe
1036	svchost.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\PCAudit.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\helpsvc.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\uploadmgr.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Nla.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\NWCWorkstation.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Nwsapagent.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\SRService.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Wmi.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\LogonHours.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Ias.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Irmon.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\Ntmssvc.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
File opened for modification	C:\Windows\SysWOW64\WmdmPmSp.dll	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5408	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
5408	jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__908bc43930527ab4eb1c0dfac9e7d123.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5408

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:1104

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4608

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2140

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5864

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:764

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5380

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4448

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2700

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2904

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fastuserswitchingcompatibility.dll

Path \??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dll
Size 139KB
SHA256 6b25fbc17f0b615d29282e3e7b9fed4f1beba30f0b92e63824a244429f4b20f7
MD5 12224c38614189aa675e89fbe84e998d
SHA1 fdfbd5355c72a86ef41a3230e470ee01252062e9
SHA512 4e7732bbba30ce0e2fa1a79506eecd982ea16f07b5c6426aec572b20553c2dabaae1f13ea635f8cfda9a5c7eb652e3d2cebac3915080c53977a5da682f10a67a
SSDEEP 3072:TH+Mcv5JXXieDEvy1W7rkD+bnAIhRjaNA:THl0ndEqgkCAaRGO
TLSH
T1C2E38E729541E8B3C24601726112A76F1EA9AF371778ECAFC7505AD93EF82E2D230357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-37-0x00000000009A0000-0x00000000009C3000-memory.dmp

Download

memory/236-36-0x00000000009A0000-0x00000000009C3000-memory.dmp

Download

memory/764-30-0x0000000000F90000-0x0000000000FB3000-memory.dmp

Download

memory/764-31-0x0000000000F90000-0x0000000000FB3000-memory.dmp

Download

memory/1036-60-0x00000000009B0000-0x00000000009D3000-memory.dmp

Download

memory/1036-61-0x00000000009B0000-0x00000000009D3000-memory.dmp

Download

memory/1096-11-0x0000000000F80000-0x0000000000FA3000-memory.dmp

Download

memory/1096-21-0x0000000000F80000-0x0000000000FA3000-memory.dmp

Download

memory/1096-10-0x0000000000F80000-0x0000000000FA3000-memory.dmp

Download

memory/2140-20-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2700-51-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2800-5-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/2904-55-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/4448-47-0x0000000000E80000-0x0000000000EA3000-memory.dmp

Download

memory/4448-46-0x0000000000E80000-0x0000000000EA3000-memory.dmp

Download

memory/4608-16-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5380-41-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5408-0-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5408-12-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/5864-25-0x0000000000400000-0x0000000000423000-memory.dmp

Download