Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 17:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
General
- Target jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe
- Size 57KB
- Sample260919-vhyytstdld
- SHA256 0fb0db06f101d6445c7bad4f3ca0ea20d1732bd9baf93feb20b06816b4ad3694
- MD5 a103d6f39144c99b197dd1d96b46a880
- SHA1 141545f4ba442205f483eeeb24bff0933e2c4887
- SHA512 c879fcce9cf01041e1ad29ffdf2d3559fb62f8126fe8a107d6bc787b7cc0862b8d5d37fe7ae373cefce39f028e5c5633c4e7e3300d23714e5552518a4cd9a60b
- SSDEEP 1536:9v+Ym+aGH2kHxy2/9L88TVptmV+z6XO4Die20RcW+jybkUfp7z9VjArO:AW2kHxy8O85ptmV++X/DiL0GWoMHflzR
- TLSH T125439D026E6CA42DE6E24A7211BE6F59423A7D72D7B453CF93085B4E1C71FD1A6303B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 4936 jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\wmfptc32.dl_ jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe File created C:\Windows\SysWOW64\wmfptc32.dll jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4936 jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe 4936 jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe 4936 jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a103d6f39144c99b197dd1d96b46a880.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4936
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\wmfptc32.dll
- Size 39KB
- SHA256 5c7df98a30e6addd842f6ad4a896b1e4c5c3de9f888d82f1cdc447dbe38de184
- MD5 340a23dfeb7b3cd1dc41982a93a7c231
- SHA1 4c9e634feb0ec1ca0d9f2005372438c965c411e5
- SHA512 de648bbef2bb3002739d0d0b1b2706a9122039a5d17791d909fc7e19c2d290c250869028b70433fea02b7376f6c76be3128dae61e33271e37c02a29f7bee9e4a
- SSDEEP 768:blcHi7v9G20BExXfKJGu8nnK5qf5NDQH53hgm2+LL9ts3/kETNyzTSN/r3:+i7vYE+qPGLg/uL/siC
- TLSH T1B103391DB251A7B6E8A5407D536A9BA7240F2DF16BD058C3BEB41FC26C740C2AE3650F
- MD5 SHA1 SHA512 SSDEEP TLSH