Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe
- Size 31KB
- Sample260920-2m76matzct
- SHA256 50a1e2d6ce927be1e8e9e7bb48fbb0c9d4525260bdeae72d0df7e7216e22d0f7
- MD5 292d3f14e36d9793cbd4d7b2b3767348
- SHA1 150523ebb440180b35e7fa39543a8f12b5303272
- SHA512 5e42c5f7867f2860143dd9da5111f2ef463c62184b18993a45b9d76bea4eb94c716616d9fb013c1e3813d7e475b4584330a57a827a15084c5f02706c1b949749
- SSDEEP 768:plsANHZx1OpfHYx7TSPmOQAEo/NPitlUnbcuyD7U+A:PHZXVx7TrOvEo/ItlUnouy8z
- TLSH T108E2E14BEE5DAC30C367407A0946E5895C389C4BAA0B747B7CCB3A3B7E407A8256D3C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240759343.DLL jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rfdltecq\jeoifz.pif jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32\ = "C:\\Windows\\SysWow64\\240759343.DLL" jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe Token: SeDebugPrivilege 3704 jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__292d3f14e36d9793cbd4d7b2b3767348.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\240759343.DLL
- Size 12.1MB
- SHA256 57879613616059bff1484c296a29a01afa520ffedd4b0efd2b858ef7a032252f
- MD5 1b4447bfc61623b88ea5b3b1c36c672f
- SHA1 f20869477c6df8ae0fd081267960984ab57ec744
- SHA512 936dd63747c4a1fb38c99455916398cbfc981c241a7be06828b203bb51e4cdde0d9681284a4639639488a638365de75ed682baab8e2009206d994e8a1f1f20eb
- SSDEEP 1536:af3mRkWEMAAF6OpCzdTRJdaVmsBttq/RT6k0CD8cgEEMyD5U:W3mivvOqTRJdaVXqJbGEEM85U
- TLSH T1E1D6E709432EB2B9F4A22DB0AC153B7B4C961DB0015FD47EFB88CA8504A7ED97A5471F
- MD5 SHA1 SHA512 SSDEEP TLSH