Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/09/2026, 03:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe
- Size 359KB
- Sample260924-dh2laace65
- SHA256 d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d
- MD5 1f3a9573d2b7c7dba54f91166d5699ca
- SHA1 053cfa888c122bda4ca4d2edfc2a211e8eef44aa
- SHA512 d2d1a350836c5a102a05fd2d0abe4b7b8b786365fc326f6d8b31e5c492cff5c28369bcb227bfd2cae77f99e3b2ae1155c2db6dfa1d59f5f2ab7e0c2f3424c257
- SSDEEP 6144:PhPl1aQr/zCPTS5HSrAz+0dvPYBSEDQltoT7H05sL2PiqR5oZVmjNtARTYF:PhPraQrrsShd4BGltYHisqaY5oTmYT
- TLSH T11974A1ECE221C49EF574757503F23EE86D51486D934F96CAE6A7E88B3CADB4E842110C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5224 Cmojia.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe File created C:\Windows\Cmojia.exe jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe File opened for modification C:\Windows\Cmojia.exe jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe File created C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job Cmojia.exe File opened for modification C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job Cmojia.exe File created C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe - Program crash 1 IoCs
pid pid_target Process procid_target 88432 5224 WerFault.exe 92 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Cmojia.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main Cmojia.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe 5224 Cmojia.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2304 jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe 5224 Cmojia.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2304 wrote to memory of 5224 2304 jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\Cmojia.exeC:\Windows\Cmojia.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:5224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5224 -s 7763⤵
- Program crash
PID:88432
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5224 -ip 52241⤵PID:88408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Cmojia.exe
- Size 359KB
- SHA256 d69a7752245c63fadf0940a93b799e3da30763ed952e29e503f264200f41972d
- MD5 1f3a9573d2b7c7dba54f91166d5699ca
- SHA1 053cfa888c122bda4ca4d2edfc2a211e8eef44aa
- SHA512 d2d1a350836c5a102a05fd2d0abe4b7b8b786365fc326f6d8b31e5c492cff5c28369bcb227bfd2cae77f99e3b2ae1155c2db6dfa1d59f5f2ab7e0c2f3424c257
- SSDEEP 6144:PhPl1aQr/zCPTS5HSrAz+0dvPYBSEDQltoT7H05sL2PiqR5oZVmjNtARTYF:PhPraQrrsShd4BGltYHisqaY5oTmYT
- TLSH T11974A1ECE221C49EF574757503F23EE86D51486D934F96CAE6A7E88B3CADB4E842110C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
- Size 454B
- SHA256 3f06c37585ec73851b279d0fbd3574f697365927c29a86ef6db9ae3a59e5027d
- MD5 9a5f33ada906f672dfba679b5b938c9b
- SHA1 ff9ec7aaa32007edbd45f9db088fb0a632e7f96f
- SHA512 184683ccc3d9a72612964921f5e3be3cc2b9e1c724b13898f5abba71c7e451a25c59d04f0e0b4154a2e3c5f66a24fc7ecddb2c92e9d047bb0ecbc0ddd4f1f21b
- TLSH T1DCF0DF3F3AE21031C773867946F28663E368F0323D22570E11C907490C12B21AF4361C
- MD5 SHA1 SHA512 TLSH