961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7

Analysis

max time kernel
148s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
Size 396KB
Sample260924-c7cssacd28
SHA256 961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7
MD5 b08a2f6f3f273ffe99c06e10c69fd0a7
SHA1 9faa151eb729f6f716604ed7c0bff2ef7a6221b3
SHA512 ff9be9b6fcafa0c7bd85d46f2a3d8386b254f8e76bb43c14ef79a76778e2e1a15f55cbc7a001a6ad5994cf089a66823ffc5281c0315b83cdfcf7304c077e050c
SSDEEP 12288:jurpcmTzm7gBauiOZJn2eED6yj6SMxbi11/aPgKGV7D6nTi:M4bDXWSIu11i4KGVY
TLSH
T1C884F8EDE242E8CEF8B075350BF32EE05D55485EA70F1AC0A67BE42BBCAD61D512494C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4696	Omijua.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
File created	C:\Windows\Omijua.exe	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
File opened for modification	C:\Windows\Omijua.exe	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Omijua.exe
File opened for modification	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	Omijua.exe
File created	C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
43684	4696	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Omijua.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Software\Microsoft\Internet Explorer\Main	Omijua.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4696	Omijua.exe
4696	Omijua.exe
4696	Omijua.exe
4696	Omijua.exe
4696	Omijua.exe
4696	Omijua.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2040	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
4696	Omijua.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 4696	2040	jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\Omijua.exe
  C:\Windows\Omijua.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 892
    3⤵
    - Program crash
    PID:43684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4696 -ip 4696
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Omijua.exe

Path C:\Windows\Omijua.exe
Size 396KB
SHA256 961e4717cd1702cf82b79eff314fc162e22c6caa350a5d3dbc6b48a331ef54f7
MD5 b08a2f6f3f273ffe99c06e10c69fd0a7
SHA1 9faa151eb729f6f716604ed7c0bff2ef7a6221b3
SHA512 ff9be9b6fcafa0c7bd85d46f2a3d8386b254f8e76bb43c14ef79a76778e2e1a15f55cbc7a001a6ad5994cf089a66823ffc5281c0315b83cdfcf7304c077e050c
SSDEEP 12288:jurpcmTzm7gBauiOZJn2eED6yj6SMxbi11/aPgKGV7D6nTi:M4bDXWSIu11i4KGVY
TLSH
T1C884F8EDE242E8CEF8B075350BF32EE05D55485EA70F1AC0A67BE42BBCAD61D512494C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

Path C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
Size 454B
SHA256 a36090db57c8de07a1cb75979ff683ab02ebcf8f02d17097411c30fa715c7ea3
MD5 cb3b280f32e528e9a329fa97e7b3c0e3
SHA1 f8961c6289220423b8422f18bbd58bfc225015c9
SHA512 6e470f4ec9d5524003fba22db812b1b8a2ce8d68e0495951c6c79ded1bfe3a820106115922ff551e4351341f80cd379d2c4fcdd5a06deb639e81eeb3399349be
TLSH
T17DF0262FBBE12061D737AEB526F6D3629BB8F93239114B0E20C546490D53E265F4321C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2040-0-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/2040-3-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4696-17-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4696-42369-0x0000000000400000-0x000000000043D000-memory.dmp

Download