Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 09:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe
- Size 1.7MB
- Sample260924-lqjpfascnd
- SHA256 4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9
- MD5 c980f4ac2afad20474e3a3f284e8a53e
- SHA1 1b6936d11d2cbfc74aacac8f8a3d24e0a5a510d3
- SHA512 6fbf8ef4216efde83361ae7239a8c163a2a5c79f2f15bd05fe7c569401791677782f8361e749545ebc49cf41d647d0384683abbd7915b578a89d4ed8e70ff507
- SSDEEP 24576:zyczSA/WWKWWBWB3nvOvJLYqurfxPv6JuO/5mrtUeyqFL0AQOi:2jAAMvOvJLYqurfxPv6JuO/crme30A/
- TLSH T1D0853036E1D6A09FF848C0FF177A72C394705F78C3892695A80EBB22ED3A575253CA54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1928 Awola6.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Awola6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Awola6\\Awola6.exe\" /MIN" jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Awola6.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe 3952 jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952
-
C:\Users\Admin\AppData\Roaming\Awola6\Awola6.exe"C:\Users\Admin\AppData\Roaming\Awola6\Awola6.exe" /MIN1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Awola6\Awola6.exe
- Size 1.7MB
- SHA256 4a14b4ebb951cde991b100625ff1218c32be644407ff2fe63542bb48a2ec6eb9
- MD5 c980f4ac2afad20474e3a3f284e8a53e
- SHA1 1b6936d11d2cbfc74aacac8f8a3d24e0a5a510d3
- SHA512 6fbf8ef4216efde83361ae7239a8c163a2a5c79f2f15bd05fe7c569401791677782f8361e749545ebc49cf41d647d0384683abbd7915b578a89d4ed8e70ff507
- SSDEEP 24576:zyczSA/WWKWWBWB3nvOvJLYqurfxPv6JuO/5mrtUeyqFL0AQOi:2jAAMvOvJLYqurfxPv6JuO/crme30A/
- TLSH T1D0853036E1D6A09FF848C0FF177A72C394705F78C3892695A80EBB22ED3A575253CA54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Awola6\settings.ini
- Size 37B
- SHA256 c31439307c3cc9290a2c7d068f5da09d6915c47f6c2878fcefd352471a2a2efe
- MD5 1de284334a9879c8ae2406f3d9df1fb5
- SHA1 b2dbcf89311b23a73bb87699a651b88a8d642275
- SHA512 2e451538e0d903c6e77cd581bb068c86ec29f77ecd79bd5ead8d94c995e7506318c305753ceda364ea920fb0393a543ed72fc779d1df048486f7c8ceedf57532
- MD5 SHA1 SHA512