ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
Size 208KB
Sample260925-3txh5sssbx
SHA256 ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a
MD5 a6d7d62a3ef0cf97b7be6471ed2032d5
SHA1 a6caa74521e4c5d398a9fe5dbafc81bd022bbfc4
SHA512 9f69a9869364ec5bb0d13a46e5e4d05f21a3d9ee52b3377ac6ae2e76a54bd8445f859c6366623918e84fb18ce513f83dcd2ee445fccd1b79395c012d015306d9
SSDEEP 3072:QzesA85T+93RGO2CqXyN3m1EplhRH2vy9WvLOUNwvjIpciirpJju:QiK+9hG6qgm6pluvRiUNIjv
TLSH
T1BA24E153F3C144BAD02E1FBD0DABD6A5963AB9B07E2515837B590B0DAC7A3803D297C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
3168	nbcstat.exe
5740	Fontview32.exe
5748	nbcstat.exe
5136	hude32.exe
1820	Fontview32.exe
1048	nbcstat.exe
3896	pstage.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	hude32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Fontview = "C:\\Windows\\Fontview32.exe"	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\nbcstat.exe	Fontview32.exe
File opened for modification	C:\Windows\apes.dll	Fontview32.exe
File created	C:\Windows\nbcstat.exe	Fontview32.exe
File created	C:\Windows\nbcstat.exe	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
File created	C:\Windows\Fontview32.exe	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
File opened for modification	C:\Windows\Fontview32.exe	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
File created	C:\Windows\hude32.exe	Fontview32.exe
File created	C:\Windows\otes.dll	hude32.exe
File created	C:\Windows\pstage.exe	Fontview32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Fontview32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Fontview32.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fontview32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hude32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fontview32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3168	2400	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe	87
PID 2400 wrote to memory of 5740	2400	jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe	89
PID 5740 wrote to memory of 5748	5740	Fontview32.exe	90
PID 5740 wrote to memory of 5136	5740	Fontview32.exe	91
PID 1820 wrote to memory of 1048	1820	Fontview32.exe	94
PID 5740 wrote to memory of 3896	5740	Fontview32.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\nbcstat.exe
  "C:\Windows\nbcstat.exe"
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\Fontview32.exe
  "C:\Windows\Fontview32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\nbcstat.exe
    "C:\Windows\nbcstat.exe"
    3⤵
    - Executes dropped EXE
    PID:5748
- - C:\Windows\hude32.exe
    "C:\Windows\hude32.exe" /hlpme otes.dll
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5136
- - C:\Windows\pstage.exe
    "C:\Windows\pstage.exe" /hlpme aged.dll
    3⤵
    - Executes dropped EXE
    PID:3896

C:\Windows\Fontview32.exe
C:\Windows\Fontview32.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\nbcstat.exe
  "C:\Windows\nbcstat.exe"
  2⤵
  - Executes dropped EXE
  PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fontview32.exe

Path C:\Windows\Fontview32.exe
Size 208KB
SHA256 ac2a8f450c70fff82f7742dfb1c4ec2be6cb4f95dcdc42f3ed8f67a19fb8100a
MD5 a6d7d62a3ef0cf97b7be6471ed2032d5
SHA1 a6caa74521e4c5d398a9fe5dbafc81bd022bbfc4
SHA512 9f69a9869364ec5bb0d13a46e5e4d05f21a3d9ee52b3377ac6ae2e76a54bd8445f859c6366623918e84fb18ce513f83dcd2ee445fccd1b79395c012d015306d9
SSDEEP 3072:QzesA85T+93RGO2CqXyN3m1EplhRH2vy9WvLOUNwvjIpciirpJju:QiK+9hG6qgm6pluvRiUNIjv
TLSH
T1BA24E153F3C144BAD02E1FBD0DABD6A5963AB9B07E2515837B590B0DAC7A3803D297C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hude32.exe

Path C:\Windows\hude32.exe
Size 35KB
SHA256 b37cea85b69616ae9188fe561e02188a7392e71addc3254da20b4ccf4d538f24
MD5 8d147fc124802833d8a677a2d4358b86
SHA1 4770e524ae619d81ce0619fa18b8ba0825acb277
SHA512 ae5faf0ac7a67403295717e7034eac3310bb3ca06d261f4188735755bf8f8f212e70504115a883089891cbb535e2616ae98e699696ce89ffe8204c9bcc673874
SSDEEP 768:6L2SoeCAEqktyiA7PkDQl2vLnyMVgUn3YSUDCrLwewfIza5r:kKeC1Rty9bkDhvLOUnI3DCPwewsa9
TLSH
T110F2E1B570DC8589D8141FF726D25F952350E010DAA4D3F0B8BC99DB705F9D2AB3A68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nbcstat.exe

Path C:\Windows\nbcstat.exe
Size 14KB
SHA256 2a5253e122605f0e8234eddd19d6af9d87a441f7d1bd9c174a5724f307333425
MD5 6dad105173d91b8a33774d61cf705056
SHA1 14a639bbd2b4eb85ee0a4d23cab35c62cd01cb74
SHA512 41970e92f586e1dc9251ef9915de22934fbda0b6301243dadf5d6de8c5bd322e1bfaf626299021597fec206ac204d6341ae554ba779e01a4237cde2e85017ddc
SSDEEP 384:SB3ua7fQnLIL++vyT1bE2YE/gyV/DQn4n2r:+3uhnpKqdhnoyV84ng
TLSH
T1D262C0059F442A5ED08CB57153657921B328563A65BFA9C59C0B7F413BC23A07A328B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pstage.exe

Path C:\Windows\pstage.exe
Size 32KB
SHA256 301c3d4562816f5abb65df62fb166121aa2995c91c1f5f432d4f77d71f238e2b
MD5 3d8f665bc1c4fe3fa9fb55d5f06c643f
SHA1 f0cde7892b9212bcce903b043f0f97d1942330cc
SHA512 2ecede2d42fd8b75540174bb006644a32ab3ca904c35404363d0fdc164a698594783d084a45783089ff4a1438f35994e71d9abbd2a811059ba03b0670c35e664
SSDEEP 768:mSZuGoz1BcGuBPzYfD2T1jbwqtYAO4m5flepJU1EfSKl6JFT:mSZux/cGuNiD2R7INlepJXzuFT
TLSH
T1E3E2F13A8E8CF0EED81F11F051A734FA6E8684C49A01D74602CD9DBD6CE65412FED4E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-27-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/2400-9-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/5136-21-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5136-24-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5740-36-0x0000000000400000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads