fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe
Size 296KB
Sample260925-2js8asyy2r
SHA256 fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36
MD5 00a12178e0d096927c116ab10ef59c65
SHA1 206fe690b6227c6bce8ae04b0f50460ed861b455
SHA512 c17d254c8bd59d53dbada758089c504bda9739e09f1f1f0a8625e2cbab266cacf3671700e17497d0f5d7690ab5aaa49f5d4b036340d0b1966a1e478d113dab8a
SSDEEP 6144:nuLH7ZNFmtVJ6Eollw+3GBzKKz8sboaVgo0eSOE15EGMvWQAaTBJc:nYDmF6EolT3GcK7f0ePcEGwTAaTM
TLSH
T1B9549E21F7C14476D0521F349C6AA67AD93ABF102D3CA547B7EC5E0D5EBE2C269283C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3444	System64.exe

Loads dropped DLL 2 IoCs

pid	Process
3444	System64.exe
3444	System64.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System64.exe	jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe
File created	C:\Windows\SysWOW64\KMe.bat	jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 4180	3444	System64.exe	91

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5776	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4576	4180	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4180	3444	System64.exe	91
PID 3444 wrote to memory of 4180	3444	System64.exe	91
PID 4396 wrote to memory of 5776	4396	jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5776

C:\Windows\SysWOW64\System64.exe
C:\Windows\SysWOW64\System64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe ¨Á
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 16
    3⤵
    - Program crash
    PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4180 -ip 4180
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMe.bat

Path C:\Windows\SysWOW64\KMe.bat
Size 132B
SHA256 5c7284613212cc91640e5bf046a61130f3e28387136affee6ae244c32a0b1a9f
MD5 eebc5538f79c16099e8a047bfdefead7
SHA1 0783aa390c7b1ce3dc3c06f580a2d2479b87fab3
SHA512 276f75a7f72a901cfe822af2a707f5948e93ab7e64609c633272add3e21985181e77ba11e6d16b1e94f133afb17de528dc2f17ae466734eacba747d1b86c8e72
TLSH
T1CFC02B49E9A9CF28000CC41B027C3B4FE17504143FCF2F012AF5C188028570CF45521D
MD5 SHA1 SHA512 TLSH

Submit Download

System64.exe

Path C:\Windows\SysWOW64\System64.exe
Size 296KB
SHA256 fa95f3a23a476a4720d17268b180da7c042942fc95eb184fadafae0ac1000a36
MD5 00a12178e0d096927c116ab10ef59c65
SHA1 206fe690b6227c6bce8ae04b0f50460ed861b455
SHA512 c17d254c8bd59d53dbada758089c504bda9739e09f1f1f0a8625e2cbab266cacf3671700e17497d0f5d7690ab5aaa49f5d4b036340d0b1966a1e478d113dab8a
SSDEEP 6144:nuLH7ZNFmtVJ6Eollw+3GBzKKz8sboaVgo0eSOE15EGMvWQAaTBJc:nYDmF6EolT3GcK7f0ePcEGwTAaTM
TLSH
T1B9549E21F7C14476D0521F349C6AA67AD93ABF102D3CA547B7EC5E0D5EBE2C269283C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3444-5-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4180-4-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4396-0-0x0000000000445000-0x0000000000446000-memory.dmp

Download

memory/4396-9-0x0000000000400000-0x0000000000450000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads