Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 15:39
General
- Target jaffacakes118__9c8f9c9afdbb74c0b032c31d1868bf22.exe
- Size 466KB
- Sample260919-s3ve2atthx
- SHA256 2d5de32762dad9cc0f8b1fe85ba3ac2f5b0105992d5de781bc27b6f98f90a80c
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9c8f9c9afdbb74c0b032c31d1868bf22.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9c8f9c9afdbb74c0b032c31d1868bf22.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\mprexe.exe"C:\Windows\mprexe.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9c8f9c9afdbb74c0b032c31d1868bf22.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\mprexe.exeC:\Windows\mprexe.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
mprexe.exe
memory/236-9-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/236-1-0x00000000022B0000-0x00000000022B1000-memory.dmp
memory/236-2-0x000000000048E000-0x000000000048F000-memory.dmp
memory/236-0-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/236-15-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/236-6-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/236-7-0x00000000022B0000-0x00000000022B1000-memory.dmp
memory/2028-13-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-17-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-37-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-35-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-27-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-41-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-33-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-39-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-18-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-19-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-31-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-21-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-43-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-23-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-29-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/2028-25-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-22-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-26-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-28-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-24-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-30-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-20-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-32-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-16-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-34-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-11-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-36-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-10-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-38-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-8-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-40-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-5-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-42-0x0000000000400000-0x00000000004D52DC-memory.dmp
memory/4036-4-0x0000000000400000-0x00000000004D52DC-memory.dmp