d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe
Size 166KB
Sample260924-kee2fa1eqg
SHA256 d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58
MD5 3df7ae4545bc6016948405e62a423ff9
SHA1 d2959fcb85aedbd359439d1e733852a734ec6de2
SHA512 59c2a3ab9b4cec2051597cab4198d759fb7fd03edcb611912e235f7655e81649922c29a9f5296a637b00b92f85d345debe0b458584bb854b3aee96c3d4d9cace
SSDEEP 1536:R4emxQXsm0wCZFpCBiobQec8OEjsvit2QfVyx8rU48fQM:R4FeboCoobQec8OQsx8r6H
TLSH
T12BF35D0F74C398B0F5B7167B824CE91D6446F839328D60A5DA071BE3C9247BBA937978
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4860	PCFlashBang.exe

Loads dropped DLL 1 IoCs

pid	Process
4860	PCFlashBang.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\pc_flashbang = "C:\\Program Files (x86)\\PCFlashBang\\PCFlashBang.exe -sys"	PCFlashBang.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PCFlashBangUninstall.exe	jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PCFlashBang\fd.dll	jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe
File created	C:\Program Files (x86)\PCFlashBang\PCFlashBang.exe	jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCFlashBang.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	PCFlashBang.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4860	PCFlashBang.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4860	924	jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d9d078577568fd9ed5121b67ec877c858d334ffc9959d641b053968eb49e9a58.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\PCFlashBang\PCFlashBang.exe
  "C:\Program Files (x86)\PCFlashBang\PCFlashBang.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PCFlashBang.exe

Path C:\Program Files (x86)\PCFlashBang\PCFlashBang.exe
Size 152KB
SHA256 fa73b50fd00ccc32982d8481503d07e36d293ed8b42deb11ec309d81b399852c
MD5 61ab25018c75a9ff487b634462f986ae
SHA1 fecb07c38f89d02b3312675d8bcd12b6add7279b
SHA512 227591b64465caad575bb3d8e88db901b20b802a5af7a6bbec7d2aa20201242d8c05f94c4256f089b9dea64b3f7db9618122de8986c8019b45712781b7b2da0e
SSDEEP 1536:MXsm0wCZFpCBiobQec8OEjsvit2QfVyx8rU48fQ:sboCoobQec8OQsx8r6
TLSH
T193E32C1F74C394B4F5B7123B824CE91D2046F439368DA0A5DA071BE389647BBA937D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd.dll

Path C:\Program Files (x86)\PCFlashBang\fd.dll
Size 6KB
SHA256 784a39d471f8e6ae6088ab53c7510dba55e2f075db2f8ccb3602736f34579ad3
MD5 c10ac2398630fe6875451d40c9949310
SHA1 2daec129a646d6d1ae0bf6d0608b07970db4d601
SHA512 b80b41dec8885beedc4f9af996512999fb5527a96d4ca716009560a87aca8e3fd42884f19dab7fdb556eb51b5894490c45fed10ce4ea8d023dd21d159b9f268c
SSDEEP 96:P1QZCoHqMqEBfAvJjk7wf0s9oiGtgawjx:UHqM7fAvWS0s9gSj
TLSH
T130C18F136B900A73D728A9B4280F4FBA6AB84A1953912903CB30DF443D661BBCE38D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads