Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe
- Size 208KB
- Sample260920-2bdsmsde28
- SHA256 919fe23b2902b844fee7c8be56d91fe686aa792c4c01e0739711951dfd5b1826
- MD5 288b86752a3efc2caa8f6330d3ab87bc
- SHA1 624a7c102100c36f7ba195ce14a966d41d6133fa
- SHA512 da1a30dfce5516be71901dca641bddac140df0ced415c6490dc19b046a5290db3f80f3017866c61c7b320cfe7990f9f9ccd1009832860a12a2992eecb569d417
- SSDEEP 3072:tto2HyJt6oobhLgaMCLgfl8wofyNqPcJC6XVZVGv9fKZ+3jnHo3hQ1bWpbT6thUM:tPHy/6TyaMCLgt8ty0Opll8iuGE
- TLSH T115248D113EC98C32C7B3C131C61A9BE9E65495320A269C27BB5C32597F7C759843EBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SinglesMSetup.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\JAFFAC~1.EXE /r" jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1880 5832 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe - Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe 5832 jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__288b86752a3efc2caa8f6330d3ab87bc.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 23842⤵
- Program crash
PID:1880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5832 -ip 58321⤵PID:4120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TOXJMFV\connecting_icon[1]
- Size 301B
- SHA256 13237f6652c8a50f987ee5227ce16778117add802584a5e19ef892eac6e1d3e8
- MD5 81f2114b7bcc913245df781df3eb9ae5
- SHA1 46beb25a2a30e66c65ebddb72f836542e3655d21
- SHA512 446e34fc67e66d60a7e4a4ee65b47ca04198a8566c4d5cc665249fed8d8616cd6d674cb82621dfea4303cd7a1f90488027b352972219873bf90094d62e763b6c
- TLSH T1F3E02B43A290529DF85AB6B08B144ACD02552F2588943A7E6556870AFC1622A6579464
- MD5 SHA1 SHA512 TLSH