Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe
- Size 195KB
- Sample260925-v2wmtatt5n
- SHA256 6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78
- MD5 2df2eb3a4d3be086b4f2ed2c2dc049de
- SHA1 989c9092e9d7d44e9393739ff89c5fe676ea67c0
- SHA512 37df86439a42df1b56b03e7764893a391aa3e1718c18a5c4b1b1307e9199943f75074db5cbcde6675db7a25d0ba7c108496f3573dccbf271739da7d4f34e2949
- SSDEEP 3072:HsqOLxpltFpqPPKULz1JihNwPcvL5nF9Pfxg1bT:CLZtrqHKKcvFD5KT
- TLSH T16C147D2072C3C072D41628768CAAD7F58A7A78714BE65ACB7BC81B7D4F352D19B35309
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\d7d5dededcdddb94dfc2df = "C:\\Users\\Admin\\dfga.exe" jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f0b3cb835ea1766bd6ee646d27822af625f71a1ec2172c34970b5f2bbea5d78.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4536