b58f11772eacb9ee63473ab94a8eb122089564462deea9add66b3b6e13f6c69e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 17:02

Target
jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Size 28KB
Sample260919-vkgsbstdmg
SHA256 b58f11772eacb9ee63473ab94a8eb122089564462deea9add66b3b6e13f6c69e
MD5 a133c61ec7426be841d767f535fcf6f1
SHA1 0ecf608fd9ed73aef647f5aee1f804f773136b3b
SHA512 b72ef0881a9f37add164bbc94601b743dba618acb8803f7ae3fdd5aad05cd19125520bca2e6dccd47a8569b265721efad35d953014b74280a1088d570eb259f2
SSDEEP 384:lNpQQjteLO/YPfrssizmlwEflzyyltH8ehKV5o5T:ns3Pzdiwy6tH8ehw5o
TLSH
T13CD23B22B8C15823C89681B11975A713B93F7AB21A65B043DB807B4E2FB19D4FD2B353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Adds Run key to start application 2 TTPs 6 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss.exe = "%SystemRoot%\\csrss.exe"	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
1⤵
- Adds Run key to start application
PID:5532

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
1⤵
- Adds Run key to start application
PID:5596

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
1⤵
- Adds Run key to start application
PID:4824

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
1⤵
- Adds Run key to start application
PID:4076

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a133c61ec7426be841d767f535fcf6f1.exe
1⤵
- Adds Run key to start application
PID:5804