9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
Size 43KB
Sample260925-w641esvs2r
SHA256 9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3
MD5 f173481ecb25f7fec96dce03796c6772
SHA1 2940a93da6521bb7e00c1b4983d0e3edd7ba0a1c
SHA512 3b535dd7b11edf484d7ebb95dccc916fab1f7721e4ddcd855c76fb86a3480d67c3aa4046e31d0833de881be6089b9d77329c4b2f9e8d1aa018c2e1555a7d7c70
SSDEEP 384:8SRKhYdKAmGffrLwvZrmXUAbZX/KMqyrXiELJ7VW7nQgIC:8lYgAbrLwvZraUA1X/rq4X3LJh2nhIC
TLSH
T1DB1339C776A90463F682847C509D1B16F3EB943837A6E7878B3582893DE84E3C97095F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5484	ctm12004.exe

Loads dropped DLL 1 IoCs

pid	Process
5484	ctm12004.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ctm12004.exe	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
File created	C:\Windows\SysWOW64\ComRes.dll	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fonts\ComRes.dll	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
File created	C:\Windows\fonts\ctm12004.ttf	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
File created	C:\Windows\fonts\ctm12004.fon	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5124	5484	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctm12004.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
4248	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
5484	ctm12004.exe
5484	ctm12004.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 5484	4248	jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\ctm12004.exe
  C:\Windows\system32\ctm12004.exe C:\Windows\fonts\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9080e9f13e7d35e17042c258214f6e1ac4fdb57219d404a0c2dbc245677381a3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 500
    3⤵
    - Program crash
    PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5484 -ip 5484
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctm12004.exe

Path C:\Windows\SysWOW64\ctm12004.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComRes.dll

Path C:\Windows\fonts\ComRes.dll
Size 12KB
SHA256 d7571ad00cc398d407e2124fd2dd80ee9be5bd6d135d6eed69949a25101b1b20
MD5 e7b7ef3a50104e694163fc5a1d34ee38
SHA1 cbe1305c6c976aab6bdd6040eabcbc879aff9f46
SHA512 3ad72b23dda237df903153a1d1a582d5d38e671f226162a380cf3435a92ffd27b5f99a8cdef4d424b40558e58e063269f090d5fce72dec9aea84978672f69cf7
SSDEEP 192:CRP/vfcUyCOCH29O7Cfo0sW8xkLh6Dv8gziKmmARP/vfmAbPRX/KMx:CAmGffrLwvZrmXUAbZX/KM
TLSH
T1EA42E88776E908A3F1828CBD11CC3A51B7E7947827A6E703873583952EE88E2CC7551F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4248-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4248-5-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5484-8-0x0000000010000000-0x0000000010017000-memory.dmp

Download

memory/5484-9-0x0000000010000000-0x0000000010017000-memory.dmp

Download