Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 22:40
General
- Target jaffacakes118_2f55f4951b7e9a9a19a80aa60807bc2a03b15c07b5ce0968672a0c6f62dfc572.exe
- Size 28KB
- Sample260924-2ltlvatelc
- SHA256 2f55f4951b7e9a9a19a80aa60807bc2a03b15c07b5ce0968672a0c6f62dfc572
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Deletes itself 1 TTPs 1 IoCs
- Drops file in System32 directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs .reg file with regedit 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f55f4951b7e9a9a19a80aa60807bc2a03b15c07b5ce0968672a0c6f62dfc572.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2f55f4951b7e9a9a19a80aa60807bc2a03b15c07b5ce0968672a0c6f62dfc572.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\240774640.reg2⤵
- Boot or Logon Autostart Execution: Active Setup
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Deletes itself
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
240774640.reg
memory/1468-2-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-4-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-6-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-8-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-10-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-16-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-20-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-26-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-30-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-32-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-34-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-36-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-40-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-42-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-44-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-50-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-54-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-56-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-62-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-66-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-72-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-74-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-78-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-80-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-82-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-86-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-88-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-90-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-92-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-96-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-100-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-102-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-106-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-108-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-112-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-114-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-116-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-122-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-126-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-128-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-130-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-132-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-134-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-136-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-138-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-140-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-144-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-146-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-150-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-154-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-158-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-162-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-164-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-166-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-168-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-170-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-172-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-178-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-180-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-186-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-200-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-202-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-212-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1468-226-0x0000000000400000-0x000000000040A000-memory.dmp