Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 21:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe
- Size 75KB
- Sample260920-zzbbbaek51
- SHA256 3fee6e5145aef27856f12a67ca569e65d90f9ab7538538467e3def3911a57ef5
- MD5 2628a937faf17a7625691b3b65262b6e
- SHA1 1d556c06600906b3ad5917cb0ce40ca83ab8c5d5
- SHA512 de6e6a547c6383918fbd772125896f0a3c66f806cdae0013ece9dc4074a12338b63701c1ae8dc6be093c4cd7a79b117acbb3b502c14807dc449761b12d00f972
- SSDEEP 1536:I3uijM3B62Y4Hqw52SVu6w37PthwJheCB3QUpktm5VZCWbD9mn:DUM3A2YMqw5I6AP2RB3QUpq+rbD9
- TLSH T18D730161D7404F94C8D95834A79B926B1B2EE1958B6AC5BDF2F2132F05984D334FC38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\4a4843504d464c09425f42 = "C:\\Users\\Admin\\AppData\\Roaming\\wjak.exe" jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wjak.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3432 jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2628a937faf17a7625691b3b65262b6e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:3432
-
C:\Users\Admin\AppData\Roaming\wjak.exeC:\Users\Admin\AppData\Roaming\wjak.exe1⤵
- System Location Discovery: System Language Discovery
PID:2456