275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
Size 61KB
Sample260925-2v4heaydmd
SHA256 275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93
MD5 e00c68ede9ed4420113be943dfce4012
SHA1 be2fce2b3bb1338f830fb061f2e7f39dca8f4d11
SHA512 e5cfd8c9a7da051442a22d410fa2d07585aa9b574c8ea195ca32a4b9fec9da130e7e04ea73fc70bcfdd31c478c995888d38079d6c2aa119a59abe70f9d9eac42
SSDEEP 1536:A1QfLeisgS3zwPSgYn7/ibTqO1v8wXEr:uQfLnTSgc7/ijvEr
TLSH
T11A538C469751C4D2F7EF95F791338A8AD2A078A20DA5481B8E809DFC0BF8CB5811FC9D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2892	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3136	2892	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1264	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
1264	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
2892	rundll32.exe
2892	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1264	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
1264	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2892	1264	jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\rundll32.exe
  C:\Users\Admin\AppData\Local\Temp\9Jc8f579icLawZ3u.dat, ServerMain 0c:\users\admin\appdata\local\temp\jaffacakes118_275df6a141f8f77ff444921cf11e32c86c08aaf43ed7b822351dfc2e4ff53c93.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 568
    3⤵
    - Program crash
    PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2892 -ip 2892
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9Jc8f579icLawZ3u.dat

Path C:\Users\Admin\AppData\Local\Temp\9Jc8f579icLawZ3u.dat
Size 13KB
SHA256 ded0f6c9c1d0e89862e7425ebed626247a86fc57ef1374cf042b7bc77be4d9d9
MD5 7c555881820b426bc607c4f47cf7b327
SHA1 6c05a02d7c306d78c6e2f42154db783255051e56
SHA512 799bf398645f7d9149ecb6feb93c2546bc764a4c296eacb155aee37c44ab792e86097c10405ceefbe9fa20178eb51a0b887368d22a0879f7ccc86c0412e5f6db
SSDEEP 192:gD0GY9E4y1EiWDUcCk1BFisjQ/kKnWE0UZyL:aqEd24k1ziKunWEry
TLSH
T17C52D6B3FB8144F2E1C2013139A7294BECE668351B69C09BDF8715956CB18D8EE7528B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download