34420e21d5801100fcc8513858aa6399510d4ec7afb7ea81193c5036a9201aa8

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe
Size 575KB
Sample260919-xc5wasaf79
SHA256 34420e21d5801100fcc8513858aa6399510d4ec7afb7ea81193c5036a9201aa8
MD5 a9858596624a72b87294c81a04f5e35b
SHA1 cbf987452f2c851e3b8d8bd7f3f514aa4ed6316f
SHA512 7b43b31438ea0487ceca1b8e4e4ba109a0a24754e46e8b69cb1cb15aa63ac1f4f9a1bf203a364231ff3bcc4a7e3adfd6be51aa37ccec227c94b2e7b0914ec40e
SSDEEP 12288:qutrzh9xOXkk3uWFXi1h7oM/kgO+3j2QlgkbyLLUlKHe+fYCr8BOoW2T:qutr5OUk3uWFXi1pb8gP3ZlgkGfUlKFC
TLSH
T181C4F1A576D4CCFAE180427059F9FB1DA2F9A97079799206E3E2098EFB74FC4B504123
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2512	Crypted.exe
2052	Crypted.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 2052	2512	Crypted.exe	90

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\__tmp_rar_sfx_access_check_240740906	jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe
File created	C:\Windows\Crypted.exe	jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe
File opened for modification	C:\Windows\Crypted.exe	jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2052	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 2512	4464	jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe	89
PID 2512 wrote to memory of 2052	2512	Crypted.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__a9858596624a72b87294c81a04f5e35b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\Crypted.exe
  "C:\Windows\Crypted.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\Crypted.exe
    C:\Windows\Crypted.exe
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 92
      4⤵
      Program crash
      PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2052 -ip 2052
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crypted.exe

Path C:\Windows\Crypted.exe
Size 687KB
SHA256 78f1245aebcbfa8bab3b8d6eef6c39f54bf3ed5ad9c1e50cc20c932345cf2261
MD5 4dabddd31b3134665e55655625e304d5
SHA1 087976a4e918eb60f56862899a96961786b90e8a
SHA512 4ce1929eedc2d9409bd8ac0b5197abb5573d490520c68807520a69939513e403d423213d2c4b35551356f8e68f390ab6eb5c65d93486f2b9d97fee796d9c0d51
SSDEEP 12288:wqimUkVHkmUWnUeW8dEMBf5zUZ5uDR7r/UFzDt4pg4BZ7u:uVKHkkUv8dEMDwZADR7r/UIpg4b
TLSH
T188E4C062F3C08D77D12727784C1B8264A8397E102F2D158A6FE8AD5C6F7D6C1392D2A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2512-10-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/2512-12-0x0000000000010000-0x00000000000C6000-memory.dmp