Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe
- Size 11KB
- Sample260924-eqacfa1s9m
- SHA256 de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f
- MD5 7181eaf53f82d5d213b42af0115bcbfb
- SHA1 35c2dabe7d4d59e54d899bf45a572ec9d44d4df9
- SHA512 760585a9a4acf378291e61292995a06252cb530aab025e72310e2fbd05e057f802b01c783783002ee034367ae3408d63f4bc8a2ae186a32a170c02b69916dd4b
- SSDEEP 192:4VX19O/eln5+vEyO5ng+v5mZgrUjLDHb3HXLT3HXn3H7GqGi+OA6W+G+yCHaukfQ:4VO/M5UJOO1nWPmpKaF
- TLSH T15D3272932DC619F4D07081B91DF203718AABB6A40C9FEE443908427BD5AE16F12FDE0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\toolbar.exe jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe File opened for modification C:\Windows\hosts jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe File opened for modification C:\Windows\mstasks1.exe jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe File opened for modification C:\Windows\test jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe 3228 jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_de43a5c526b24245a34041f6f94c15f8454e3d7a541c36d2f374f0d7762ec88f.exe"1⤵
- Drops file in Drivers directory
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3228