Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe
- Size 31KB
- Sample260925-15fnnaxgqa
- SHA256 12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83
- MD5 38d19ec26b63c172a22ee67dca5fc25f
- SHA1 7ab9b0d6c836c9c72b8408c0d5875ce209030a7c
- SHA512 1877fb154e72c112f3494ee5667eca070387dee882e3b2a0cb23044984d4a272b61ba5c8fda633eee05bb367a762e16e3253867aeed91c3a8d70bee52d763696
- SSDEEP 768:DDB6BZ3H9nYXqKV/rtS0Kl3D5Pn3FYJTO54+lXhnbcuyD7U:+Z3H93AS0KN9tkTO9hnouy8
- TLSH T155E26D07B6A4CAE0D5B50530405FA772696EACB59F4015EBFBC03D2779767E0643C28B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\some = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe" jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe - Executes dropped EXE 1 IoCs
pid Process 1096 scm.exe -
resource yara_rule behavioral2/files/0x000700000001b857-3.dat upx behavioral2/memory/1096-4-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1096-6-0x0000000000400000-0x0000000000408000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe 1096 scm.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 1096 scm.exe 1096 scm.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1096 1788 jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12bc1a489b90280c39e49da9632f165be1e9f50d67ee54732c63a381670caf83.exe"1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\scm.exeC:\Users\Admin\AppData\Local\Temp\scm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\scm.exe
- Size 9KB
- SHA256 b739c5ad841e3df5c27a277d81f3fcdfcfc7f6016d541b147b6dabf837b07a95
- MD5 91ca5a0f0a90ad56bfa2cf2657a9d6d7
- SHA1 73b2d22474fe8547923766f2b5e403773928548b
- SHA512 3d2dee797609049e9b99c06c7f8cebebe735a47ea3d9a888cebd97fe87516e5f541d4a0a6d5b596bea86725941be3c6716248683cbd3c265538a9fd6cc91ed00
- SSDEEP 192:Umj0uqdU+PYFNVlHaMAcbEcPvaSI/FaNJhLkwcud2DH9VwGfctoiR:Um4uXcYFvk/cjvgaNJawcudoD7ULR
- TLSH T1A3127CD1E1F6BF80D1AC163A099F75062E28F12DBA805BA6EFD430375961B28755CBC3
- MD5 SHA1 SHA512 SSDEEP TLSH