7f354ed1163aecad8a02ad61e76020a0a75fa06d8077ef2015251fe4fedcc551

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe
Size 32KB
Sample260920-189e5sdd96
SHA256 7f354ed1163aecad8a02ad61e76020a0a75fa06d8077ef2015251fe4fedcc551
MD5 2872cd39876f7a0d1b6bb2a852ba4d6a
SHA1 6af1a8aa9d9d1574661ea0e83fa8836138e5b607
SHA512 ec5ebfa21176412aa7fb4299851263ce74a07fb4d5b8f96ed96e3a90c718171e941382bf59416b504d45f4c7ad6535a7ff07a349e6dff4d33069e5e09eed01cb
SSDEEP 768:jAum/U12tZAW/BXcTjX/O8KDbZSWn6yHW:LiI2tZ7XqYZvn6yHW
TLSH
T1A1E25C47DED558F2F42300B8542FABB6D8B358A78B5FB2D6AF40DC8E2836510F52625C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1380	yiomqg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\yiomqg.exe	jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1380 set thread context of 5880	1380	yiomqg.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5396	5880	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yiomqg.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5176	jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5176	jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe
5176	jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe
1380	yiomqg.exe
1380	yiomqg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 5880	1380	yiomqg.exe	90
PID 1380 wrote to memory of 5880	1380	yiomqg.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2872cd39876f7a0d1b6bb2a852ba4d6a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:5176

C:\Windows\SysWOW64\yiomqg.exe
C:\Windows\SysWOW64\yiomqg.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5880 -s 16
    3⤵
    - Program crash
    PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5880 -ip 5880
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yiomqg.exe

Path C:\Windows\SysWOW64\yiomqg.exe
Size 32KB
SHA256 7f354ed1163aecad8a02ad61e76020a0a75fa06d8077ef2015251fe4fedcc551
MD5 2872cd39876f7a0d1b6bb2a852ba4d6a
SHA1 6af1a8aa9d9d1574661ea0e83fa8836138e5b607
SHA512 ec5ebfa21176412aa7fb4299851263ce74a07fb4d5b8f96ed96e3a90c718171e941382bf59416b504d45f4c7ad6535a7ff07a349e6dff4d33069e5e09eed01cb
SSDEEP 768:jAum/U12tZAW/BXcTjX/O8KDbZSWn6yHW:LiI2tZ7XqYZvn6yHW
TLSH
T1A1E25C47DED558F2F42300B8542FABB6D8B358A78B5FB2D6AF40DC8E2836510F52625C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5176-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5880-1-0x0000000000400000-0x000000000040C000-memory.dmp