275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
Size 61KB
Sample260925-2v4heaydmd
SHA256 275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93
MD5 e00c68ede9ed4420113be943dfce4012
SHA1 be2fce2b3bb1338f830fb061f2e7f39dca8f4d11
SHA512 e5cfd8c9a7da051442a22d410fa2d07585aa9b574c8ea195ca32a4b9fec9da130e7e04ea73fc70bcfdd31c478c995888d38079d6c2aa119a59abe70f9d9eac42
SSDEEP 1536:A1QfLeisgS3zwPSgYn7/ibTqO1v8wXEr:uQfLnTSgc7/ijvEr
TLSH
T11A538C469751C4D2F7EF95F791338A8AD2A078A20DA5481B8E809DFC0BF8CB5811FC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1724	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1724	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	1724	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4276	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
4276	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
1724	rundll32.exe
1724	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4276	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
4276	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 1724	4276	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe	86

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\eKp8DiEABxAvtsa8.dat, ServerMain 0c:\users\admin\appdata\local\temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 660
    3⤵
    - Program crash
    PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1724 -ip 1724
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eKp8DiEABxAvtsa8.dat

Path C:\Users\Admin\AppData\Local\Temp\eKp8DiEABxAvtsa8.dat
Size 13KB
SHA256 13db68dbec965f085f1cf71e866c165fd94925ed2c9a59f50b05418aac07d4af
MD5 222452cbe3781c19b82ba30ff90799c9
SHA1 12a1223a7abca383e5033b1bd51c8aea61c8e7e6
SHA512 50a40e52e7fb6690226feffffce6f660c10d39065d11c838f3167b6be497423a047b6121222a834c13be251cb2050d21c10415b83400bba5db72ceb0485d1686
SSDEEP 192:HD0GY9E4y1EiWDUcCk1BFisjQ/kKnWE0UZyL:hqEd24k1ziKunWEry
TLSH
T15D52D6B3FB8144F2E1C2013139A7294BECE668311B69C09BDF8715956CB18D8EE7538B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4276-5-0x0000000000400000-0x0000000000413000-memory.dmp

Download