1adc6966f890b76b9d84c6ef6f3345a1a638df9ffa6c60a2dba507167b626207

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__24237dd5e6cd7c5d2c8c97742c25b8fe.exe
Size 18KB
Sample260920-ytx3fsdk7t
SHA256 1adc6966f890b76b9d84c6ef6f3345a1a638df9ffa6c60a2dba507167b626207
MD5 24237dd5e6cd7c5d2c8c97742c25b8fe
SHA1 7b708936945d9b950d47ca9f2030a63ee3027115
SHA512 b55de29ed2d5240723e32d5ce2914d4b0b58bbab7f29ad2b72ae9852c5d32dd200c290140e3e67de4fa3691c4ca54522a1baa7ea514d3a52c93e16202e03df6b
SSDEEP 192:nVzpxm3zld97t0zVD2vQm5NwUcl4P0TnU:VXYHh0hNg/cl4PqU
TLSH
T1DE82632EE7D14DD4D8C0AFF005D68791F83AA475126CA24703B368AA9E78D62DD3C35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2376-0-0x0000000000400000-0x0000000000406000-memory.dmp	upx
behavioral2/memory/2376-1-0x0000000000400000-0x0000000000406000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	2376	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__24237dd5e6cd7c5d2c8c97742c25b8fe.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__24237dd5e6cd7c5d2c8c97742c25b8fe.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__24237dd5e6cd7c5d2c8c97742c25b8fe.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 264
  2⤵
  - Program crash
  PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2376 -ip 2376
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2376-0-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/2376-1-0x0000000000400000-0x0000000000406000-memory.dmp