5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe
Size 28KB
Sample260924-e8kacsyxbv
SHA256 5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa
MD5 9a2e46c09675ebfb89d009aef480977b
SHA1 3941050a65629e19e55d6b705fc44237bc29fa8f
SHA512 abda5f654b618d71dd2d7413f8ab8d32fb30e02b8ecccec8981b0d0d1b465b93e76efa841d909387271cb2c6e040eaf6bce5219419b5d4deebcb606957b9ab09
SSDEEP 384:Pgf1E4aDVChV8ToiGvI+JM7YGC4sYAr2FB9YOzjHTT:KE40Q7niG40uAreHYsT
TLSH
T1D5D2D7F21752DDA5DD1464762B168D4DC119E028762C0AF79394EF8B00FAEEBC60BF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	3236	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3236	jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe
Token: SeSystemtimePrivilege	3236	jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5502c30f40dff6e8153083d6b1f73ff9bcdd8c84774b9b7a160fe314fdeadbfa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 436
  2⤵
  - Program crash
  PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3236 -ip 3236
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads