Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 03:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe
- Size 348KB
- Sample260924-dhk9asybnd
- SHA256 d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67
- MD5 ca95bf5fc0005d0836fbca20aecc68c4
- SHA1 48597bdcdff5c3fe0bd91b5302f2fc8f92f1be67
- SHA512 082a586166dbc988bfd6307d161f11bb5467b49970df638d8c55aa5216f718d5094d465dfafa5c837a0cbd2c5e6661629c7c722aae11e75f71051f55dd8ae60b
- SSDEEP 6144:oya9zEgvPWjjai7ylWxIm39kV2yJtFF+3VyAb9E2521:z0z/vPm2i7ylOtkkQtFF+FyARE25
- TLSH T1A174B4FCDA15C89EF870662543B32DE86D55485DA34F1ACEA57BD89B3CDCA8ED02210C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\HJRUDZ5DT2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe" jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe - Contacts third-party web service commonly abused for C2 1 TTPs 1 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 mediafire.com - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe File opened for modification C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3208 1760 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe 1760 jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 18962⤵
- Program crash
PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1fa590ef227f4eab07c1c2f0b4091f80b500a5d267a8952b568436fe84f5f67.exe1⤵
- System Location Discovery: System Language Discovery
PID:2488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1760 -ip 17601⤵PID:6248