Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe
- Size 40KB
- Sample260925-w7rrgstepf
- SHA256 46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1
- MD5 e2bd5a1d1ba78e74d03e3d8aa4945f5d
- SHA1 fb962dbbe0c74361d395d29c39a56ce9d9aa49c4
- SHA512 c18389eafa73923d65ddcf3bab3ba69f08f096b913cc50492a732d71176f847701c3fdab30a8f2eed36619de09211bf495b6882adf818a4cd11a0bca452f2293
- SSDEEP 384:wYD77UNk6bFwf/uPykpZUy32iDqf2Se0L5m0b7pd+jQWSMRpYc3qW5KnzIeP:pzGk6bFwHyyg32ic37fM7LYhrP
- TLSH T13F038E866E4DEDA3C7E39879124884AFC7D4927538207C46D35083C62CFA9F6A57D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\skcfujQ5EDN.dll jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\fOnts\YywxhF7TSnkktrJw.Ttf jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID\{76CBCF38-0583-44C7-A1AE-D463DFE625EC}\InprocServer32 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76CBCF38-0583-44C7-A1AE-D463DFE625EC} jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76CBCF38-0583-44C7-A1AE-D463DFE625EC}\InprocServer32 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76CBCF38-0583-44C7-A1AE-D463DFE625EC}\InprocServer32\ = "C:\\Windows\\SysWow64\\skcfujQ5EDN.dll" jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76CBCF38-0583-44C7-A1AE-D463DFE625EC}\InprocServer32\ThreadingModel = "Apartment" jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe Token: SeDebugPrivilege 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1192 2472 jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_46d530c194af771593dd2b0d2264dd1d3b07a85b6df72afe47ca2567691b08c1.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE >> NUL2⤵
- System Location Discovery: System Language Discovery
PID:1192
-