Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe
- Size 43KB
- Sample260920-3aqlgsvvcs
- SHA256 7bd1625f2dcb940d31569be8f84da0d48c7d11251f19fafcc426855183cdb049
- MD5 2a34063fa8d8b224dcdbb0e553db306c
- SHA1 83939a0668b14fd0f5ebfac4198e854509885f28
- SHA512 9c60ae8e8c5b884e2cb6a2f64dcd046cca0225d0cbaf1145b84b1e58976e03188a78bbdd61084364549a2316e636deb4a290ecbe8f8e837f3505742ef3650c56
- SSDEEP 768:Xay9CTYk5ur5bZZrnulDIWKbeDOCjl3xblwyadukw4pEqTre:XafYk5ibZZrnaDzKCDDJxbWyaO4pEqTa
- TLSH T1E913F1C3F366086BE3AA9A7604CDEFAD703B7B2B5630D7855473636B2C2D7041462178
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5556 jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Redirect = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe" jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\backup.old jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe File created C:\Windows\SysWOW64\backup.old jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://win-eto.com/hp.htm?id=9" jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://win-eto.com/hp.htm?id=9" jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4104
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a34063fa8d8b224dcdbb0e553db306c.exe
- Size 43KB
- SHA256 7bd1625f2dcb940d31569be8f84da0d48c7d11251f19fafcc426855183cdb049
- MD5 2a34063fa8d8b224dcdbb0e553db306c
- SHA1 83939a0668b14fd0f5ebfac4198e854509885f28
- SHA512 9c60ae8e8c5b884e2cb6a2f64dcd046cca0225d0cbaf1145b84b1e58976e03188a78bbdd61084364549a2316e636deb4a290ecbe8f8e837f3505742ef3650c56
- SSDEEP 768:Xay9CTYk5ur5bZZrnulDIWKbeDOCjl3xblwyadukw4pEqTre:XafYk5ibZZrnaDzKCDDJxbWyaO4pEqTa
- TLSH T1E913F1C3F366086BE3AA9A7604CDEFAD703B7B2B5630D7855473636B2C2D7041462178
- MD5 SHA1 SHA512 SSDEEP TLSH