Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe
- Size 45KB
- Sample260925-2px4faycmd
- SHA256 c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f
- MD5 61921d9f1b87f664852ed2bd1486feb7
- SHA1 665e16a43dbe211575d27b373b6dbb9784ad8228
- SHA512 a95f185bb405c46526b3ba6c37bbffdd489060177d040898cfde82dd95ecbca0127ba091d5c6b218456a6ef1d491308133b7d7fa44e6f4b6f4e523b099561f5d
- SSDEEP 768:aI4CHAU7zb9y3OEiDM75ocBvKwJW22ffANiEIym/5Q:a6HX95EiDM75xBvPJL22rIyG
- TLSH T1F323BF8B7B880D53CBC6523A064ED97EDBF982352E347F13C78483086A357D6E87A119
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Loads dropped DLL 2 IoCs
pid Process 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
resource yara_rule behavioral1/files/0x000d00000002430f-6.dat upx behavioral1/memory/1688-7-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral1/memory/1688-13-0x0000000010000000-0x0000000010015000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\JXGvg56A6qE3Kgb.ico jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe File opened for modification C:\Windows\Tasks\zUzgU8WWpYntt6NfUWT.inf jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
pid pid_target Process procid_target 1456 1688 WerFault.exe 85 3628 1688 WerFault.exe 85 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DEA30687-C84E-4588-A761-5F2749455B2F}\InprocServer32\ = "C:\\Windows\\Tasks\\zUzgU8WWpYntt6NfUWT.inf" jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DEA30687-C84E-4588-A761-5F2749455B2F}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID\{DEA30687-C84E-4588-A761-5F2749455B2F}\InprocServer32 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DEA30687-C84E-4588-A761-5F2749455B2F} jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DEA30687-C84E-4588-A761-5F2749455B2F}\InprocServer32 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe Token: SeDebugPrivilege 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1688 wrote to memory of 4804 1688 jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c2fe90944541227d60e7a486af7657620b93c35f9295b92a01cfc78be83bda5f.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 5282⤵
- Program crash
PID:1456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 5402⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:4804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1688 -ip 16881⤵PID:868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1688 -ip 16881⤵PID:4064
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Tasks\zUzgU8WWpYntt6NfUWT.inf
- Size 21KB
- SHA256 b4c20239ac7ccba5d0b638a41e2fbd38d740a1d3dc2f6e02afb3ce47ee934438
- MD5 dc6b7806dccf1350c0b1a70cb1c98b32
- SHA1 f62c8ff3437a7360c958fbcef4be684803d55cf3
- SHA512 3a40624cf7339b72d24b8a6461279cd8f52ebdf220d1799c980d3b2db2478ebb965744208f7a3daf31d666a2762846ade30261c94a0d73e0b9280c20de1d9977
- SSDEEP 384:vOPs7iDM75o0bVI6dIVctKwJ78V+sd2LGJf42AFoaieVIvAFm6K5jADQ4:vOEiDM75ocBvKwJW22ffANiEIym/5Q
- TLSH T17CA2D08FB3C41E16C9CA36BA475BEAB9273441630F381F264A898305EB24587DDAB025
- MD5 SHA1 SHA512 SSDEEP TLSH