Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe
- Size 1.8MB
- Sample260924-lq4plsys3k
- SHA256 842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82
- MD5 8eb1352f6d4f461270c12ffcb71715c6
- SHA1 394f326803375d9c2f9494948d705253d29ada37
- SHA512 4d48a05098a13bd495203cd13b49c2364ad16bd6c1d7cf2bbd82c0d83dcb4d3513d153e5ccae4655259638d166e5a9f71c0422a48947d359b672446683fe4c44
- SSDEEP 24576:5Zeyh5SapQWNZOyxEu0uOe5mrtUeyqFL0AQOi:5RGapQWNZOyxuuOecrme30A/
- TLSH T11C95615B5DB188A7E6BEDD30F85AB33D9F2B2F1482180D699C997504F7B81B38024C79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5736 Awola.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Awola = "\"C:\\Users\\Admin\\AppData\\Roaming\\Awola\\Awola.exe\" /MIN" jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Awola.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe - Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe 4056 jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4056
-
C:\Users\Admin\AppData\Roaming\Awola\Awola.exe"C:\Users\Admin\AppData\Roaming\Awola\Awola.exe" /MIN1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Awola\Awola.exe
- Size 1.8MB
- SHA256 842eec06b9c7b4004865902535fd9d56134ed93cd8b21bed5c8fa9ae1d652f82
- MD5 8eb1352f6d4f461270c12ffcb71715c6
- SHA1 394f326803375d9c2f9494948d705253d29ada37
- SHA512 4d48a05098a13bd495203cd13b49c2364ad16bd6c1d7cf2bbd82c0d83dcb4d3513d153e5ccae4655259638d166e5a9f71c0422a48947d359b672446683fe4c44
- SSDEEP 24576:5Zeyh5SapQWNZOyxEu0uOe5mrtUeyqFL0AQOi:5RGapQWNZOyxuuOecrme30A/
- TLSH T11C95615B5DB188A7E6BEDD30F85AB33D9F2B2F1482180D699C997504F7B81B38024C79
- MD5 SHA1 SHA512 SSDEEP TLSH