Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe
- Size 481KB
- Sample260919-t7vr2ahc99
- SHA256 b598e05714e269248393fb8b68dca6cd401ef8c9010e379570274caa94b9a74e
- MD5 9fc87b9963dd32c9b371bae4580001f8
- SHA1 172f7307e17cfd14b63bd3122a400b1d5bd092d9
- SHA512 82f34512cc0c04b75810c62b58d113e9ca31b1678d5757a8cfab6fe023a1fb773309ce3b1b98cb8d66a6046146f8a88266f012ec1b7358947fb85e487d3a2137
- SSDEEP 12288:Err6s2U+dcdsS3ZuK44WrfOT5zBf7flP8+XCM+5ppxxrSacEi0/3IWV//2cAhr:Ev6s2U+dcduG5zBTflZyMed/o
- TLSH T1F3A4F9532ACB0CB6C89223F495872776A7389E358517CB6BA754CC36DFA36C0BD69301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\ScanRegistry\ = "C:\\Windows\\viotcuº.exe" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\viotcuº.exe" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\ = "C:\\Windows\\viotcuº.exe" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\viotcuº.exe jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe File created C:\Windows\.limewire\limewire.props jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3536 1540 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{04E214E5-63AF-4236-83C6-A7ADCBF9BD02}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{04E214E5-63AF-4236-83C6-A7ADCBF9BD02}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{644E432F-49D3-41A1-8DD5-E099162EEEC5}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0E5F0222-96B9-11D3-8997-00104BD12D94}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8EB3FF4E-86A1-4717-884D-7BA2D38272CB}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9B03C5F1-F5AB-47EE-937D-A8EDA626F876}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0E5F0222-96B9-11D3-8997-00104BD12D94}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9B03C5F1-F5AB-47EE-937D-A8EDA626F876}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7B297BFD-85E4-4092-B2AF-16A91B2EA103}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{644E432F-49D3-41A1-8DD5-E099162EEEC5}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6414512B-B978-451D-A0D8-FCFDF33E833C}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6414512B-B978-451D-A0D8-FCFDF33E833C}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8EB3FF4E-86A1-4717-884D-7BA2D38272CB}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7B297BFD-85E4-4092-B2AF-16A91B2EA103}\ jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BB21F850-63F4-4EC9-BF9D-565BD30C9AE9}\Compatibility Flags = "12193112" jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9fc87b9963dd32c9b371bae4580001f8.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1540 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 4642⤵
- Program crash
PID:3536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1540 -ip 15401⤵PID:4848