996ee1c3b948da7e339f423db76fdf7c8e3aa6966ec804b53a5575518e748c5f

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe
Size 20KB
Sample260919-pbw8rsfb63
SHA256 996ee1c3b948da7e339f423db76fdf7c8e3aa6966ec804b53a5575518e748c5f
MD5 91e00ec35e4d663f04d29e3f4c91a3c8
SHA1 7f307d226b4bc944e86e7ce41c80495b98ad944d
SHA512 e96ee90f2fc4a707dae4e8da3891c47c6a111a22ca1106f65f52afe07bd9797e94a0a7c20877f2c57cb06fb0505c12a9c2a7d9ba975da56e32f7310e83f338ab
SSDEEP 384:1flCp8oNr1YCeE7NaFOWa5IZyRXlhoHh:1fQp7fec7IZ8u
TLSH
T150A2A395BBA5D931F05000BBA678D366216D74704B8FA4D3F3E15E82A5302E1BB7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4176	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\system32\\system.exe"	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4656	4176	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91e00ec35e4d663f04d29e3f4c91a3c8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 808
  2⤵
  - Program crash
  PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4176 -ip 4176
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2EA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EA7.tmp
Size 2.1MB
SHA256 974e92b2a97436569c49462a80471bbc255a8b493fc90e2456996c09aed7518b
MD5 ab643592c60ae22b34fef0ff90dc0f07
SHA1 a7ded0b66d1e3e89b285f781e9defe00c6eb0528
SHA512 a1964a377f1499866f7c5d87a70004fc059140e4249502bca540bc3b92eae9e39605b082894a4246f5381fbacf5430f4797b40d405b9e1bcb3cc49c1ee9f33b3
SSDEEP 49152:FeSoNo12Vhg0TCHn0jyuCFUj+opuJo5h4vlng5M:F1oQ+hk+yusUbpuJo5h4x
TLSH
T1BEA58C23F45960A6CCF312F0914D773A92EC97308B2488C367B55AEBF9619C15B3279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads