7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505.exe
Size 33KB
Sample260925-v13dzascja
SHA256 7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505
MD5 3443cd9bca4eb6df9db7950d1561e910
SHA1 4388778bc87f959d5ad94819ee28421cc3c245f7
SHA512 ca23c90a2522c0f415a314351f99613dff090f0057cf540fe9efc87c13c56d4be109c9fcd2b8f21d00d7df60acf864e4419769de30d0dc990c5a16cd070b0d81
SSDEEP 768:0Eodker9fEz7g9dLwNLcjHTokxDlsdjbJ1UPnahAXCk:0EQ99fEzHWHkss9bH8ahASk
TLSH
T178F2AF9D33642971D43F883CA25C715148FEA8746D7C604EEB921422B8F56E9FA3CE47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
256	3652	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	jaffacakes118_7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7f3f29aeb733cc213b1382af8ff5894c5b101d3a23ec20af6409adf1fc5f8505.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 436
  2⤵
  - Program crash
  PID:256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3652 -ip 3652
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads