9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6.exe
Size 38KB
Sample260924-eayebsdd25
SHA256 9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6
MD5 76dda71c1538bf12004632a0d36aa406
SHA1 7c64a7c2206032386db50d94cd69078918e0e7eb
SHA512 194c01478560014329ef004ca5c2a3376cac159c6a0430139c77d5bc258fa1fc66089b7970fbe737763fd619e5d827f1bbcb0117a69704fcc688077adacce7a6
SSDEEP 768:s+D7U6DY14m3Gkw4/eLPkmfIuIg19OoAD:s+9gn3GMmflL9OdD
TLSH
T10403F921B7EBC233D903E2F00855B17F5423E924976799DBBB502BFA0A319D06C762E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\b4b6bdb4aeb6abf7bca1bc = "C:\\Users\\Admin\\mwor.exe"	jaffacakes118_9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9b0a761bee8ec2c2b895fdbcedf69e9fedb41b45ee7c5f3a939fc9c33de944a6.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads