996ee1c3b948da7e339f423db76fdf7c8e3aa6966ec804b53a5575518e748c5f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe
Size 20KB
Sample260919-pbw8rsfb63
SHA256 996ee1c3b948da7e339f423db76fdf7c8e3aa6966ec804b53a5575518e748c5f
MD5 91e00ec35e4d663f04d29e3f4c91a3c8
SHA1 7f307d226b4bc944e86e7ce41c80495b98ad944d
SHA512 e96ee90f2fc4a707dae4e8da3891c47c6a111a22ca1106f65f52afe07bd9797e94a0a7c20877f2c57cb06fb0505c12a9c2a7d9ba975da56e32f7310e83f338ab
SSDEEP 384:1flCp8oNr1YCeE7NaFOWa5IZyRXlhoHh:1fQp7fec7IZ8u
TLSH
T150A2A395BBA5D931F05000BBA678D366216D74704B8FA4D3F3E15E82A5302E1BB7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4900	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
996	4900	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4900
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 820
  2⤵
  - Program crash
  PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4900 -ip 4900
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ECDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\ECDC.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads