9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe
Size 47KB
Sample260925-w9ppxagg95
SHA256 9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da
MD5 62e3f2b58e4ae3e8945c0605aa86c4bf
SHA1 f9ee9435057b8246e2f0ce05d9d5b455ad3a7a6e
SHA512 d2fa93643647063f272b5fbe3b7338b10f9ea5e6b36adcc9a749a84ab87b049814ee05ea2d03d8c483ed8e2479ef3cc8996e3fde3b6f0242f8506db334fb69e9
SSDEEP 768:6WrUxlDmpi10WdPIquc2gmwkHe3odaZkLSU1n1lDEWYP:6fuWdPaiuL9EWw
TLSH
T11123391B7B8548F2C19A427476853A3749AFAC38066E58E7DF2375822CB01E5ED3DE43
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\gbvgbv20.exe	jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe
File opened for modification	C:\Windows\SysWOW64\gbvgbv20.exe	jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\fonts\dbr20015.ttf	jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe
File opened for modification	C:\Windows\fonts\dbr20015.ttf	jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2464	4676	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9c83475409044beabc2f0e7682447b7a7ec0aac456fa2f556aac9ae6dc6bb4da.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 316
  2⤵
  - Program crash
  PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4676 -ip 4676
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4676-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4676-9-0x0000000000400000-0x000000000040E000-memory.dmp