0ca40e1e54aae23211aab4cbaea32c37a044f994e75d6c6eb3f472e42de82abf

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__26f049268aaf4c84c52b5f0f7e7ef422.exe
Size 76KB
Sample260920-1dcspazz3j
SHA256 0ca40e1e54aae23211aab4cbaea32c37a044f994e75d6c6eb3f472e42de82abf
MD5 26f049268aaf4c84c52b5f0f7e7ef422
SHA1 2f019788045e8a3534728cd789d0964ec6c0dbf0
SHA512 73d7dbee67bc766a4f0410ad622df974feb27d04e549974dd32d4933b9c3bfb7ed5aeeece62e6ee596554ded06bb3c1ab7a7c1e947354c2a1f7e93a89ab7f67b
SSDEEP 1536:mP5x+TtYtNDjgoSeSQrzw/5HyU0Rj3eoZ7tGPffH1JNucho+JUPqRi4/zO:mxQTazDEoSepwdyUUjuorGPffYc1UPqE
TLSH
T1C373021A18FD0BC1ECBBDB760EEC1A5C5BAC67258B174566D582CB4A43B3F5580B0336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral2/memory/4668-2-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4704	4668	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__26f049268aaf4c84c52b5f0f7e7ef422.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26f049268aaf4c84c52b5f0f7e7ef422.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26f049268aaf4c84c52b5f0f7e7ef422.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 400
  2⤵
  - Program crash
  PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4668 -ip 4668
1⤵
PID:5672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4668-0-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/4668-1-0x0000000000A00000-0x0000000000A04000-memory.dmp

Download

memory/4668-2-0x0000000000400000-0x0000000000432000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads