9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
Size 43KB
Sample260925-w626tsvs2p
SHA256 9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04
MD5 312f7480cfba014fce04d589156771cc
SHA1 25f79d69bd7cd440d3d43ca620cd31936f89c09b
SHA512 530e6bdcf477471d29cd42659eccff3bdbc6f7c930d7d68e918b2c722fb00cc63d19fca86362c25c0de393d99ac008266edb6fd52efdaa114084911536dc7164
SSDEEP 384:8SRKhYdKAmGffrLwvZrmXUAbZX/KMqyrXiELJ7VW7nQgIx:8lYgAbrLwvZraUA1X/rq4X3LJh2nhIx
TLSH
T1371339C776A90463F682847C509D1B16F3EB943837A6E7878B3582893DE84E3C87095F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4592	ctm12004.exe

Loads dropped DLL 1 IoCs

pid	Process
4592	ctm12004.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ComRes.dll	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
File created	C:\Windows\SysWOW64\ctm12004.exe	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fonts\ComRes.dll	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
File created	C:\Windows\fonts\ctm12004.ttf	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
File created	C:\Windows\fonts\ctm12004.fon	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4408	4592	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctm12004.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4948	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
4948	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
4592	ctm12004.exe
4592	ctm12004.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4592	4948	jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\ctm12004.exe
  C:\Windows\system32\ctm12004.exe C:\Windows\fonts\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9a2fe809f0b1f40fc1c11964c7710b2310509c95e89039618409a30d28d9fb04.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 500
    3⤵
    - Program crash
    PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4592 -ip 4592
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctm12004.exe

Path C:\Windows\SysWOW64\ctm12004.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComRes.dll

Path C:\Windows\fonts\ComRes.dll
Size 12KB
SHA256 d7571ad00cc398d407e2124fd2dd80ee9be5bd6d135d6eed69949a25101b1b20
MD5 e7b7ef3a50104e694163fc5a1d34ee38
SHA1 cbe1305c6c976aab6bdd6040eabcbc879aff9f46
SHA512 3ad72b23dda237df903153a1d1a582d5d38e671f226162a380cf3435a92ffd27b5f99a8cdef4d424b40558e58e063269f090d5fce72dec9aea84978672f69cf7
SSDEEP 192:CRP/vfcUyCOCH29O7Cfo0sW8xkLh6Dv8gziKmmARP/vfmAbPRX/KMx:CAmGffrLwvZrmXUAbZX/KM
TLSH
T1EA42E88776E908A3F1828CBD11CC3A51B7E7947827A6E703873583952EE88E2CC7551F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4592-8-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/4592-9-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/4948-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4948-5-0x0000000000400000-0x000000000040E000-memory.dmp

Download