Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe
- Size 143KB
- Sample260925-wbl65asfjb
- SHA256 c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3
- MD5 360bd5f668c32ad045948b3bc5ce5cba
- SHA1 8740826229af3d4d67a0b4ce76b668fd7fe96b84
- SHA512 cf9af41920b874606cec1162b4a212066ddf8f199c04224a88a9a9147251d758cc3ec3d8c70e5057feb7312aeb948a65465ed4e71953cc3815c4ffbe27bb91c6
- SSDEEP 3072:mF2OQrUlA7HN088UFql/NlkaVHLIjVuPpi/6Fi9T0w8a3bwYE+/t:WQrL21dNl5Y6spbL3kYE+
- TLSH T139E36C25B2F38872C2B37F784D029E98A43E79613D75205A73E91F0D5D78BA46A2C353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shell.pci jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe File created C:\Windows\SysWOW64\Shell.exe jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe File opened for modification C:\Windows\SysWOW64\Shell.exe jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5244 wrote to memory of 4892 5244 jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe 89 PID 4892 wrote to memory of 2576 4892 net.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87da3.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Windows\SysWOW64\net.exenet stop server /y2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop server /y3⤵
- System Location Discovery: System Language Discovery
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c57d3ef8173fa7dbc405cdf72712848365a627dac540416ede5420ffa9e87dae1L1~.exe
- Size 80KB
- SHA256 feab2bc5d39e7fd6730102e6aa079b5702fd0c1c21d1a5c517055b76d361ec3c
- MD5 16633e22254de23fa6828fcccba88aa5
- SHA1 864cf5554f2b9bd2dc066e4ae4d761ed8b0f48d1
- SHA512 4566087a16f7aaf51db834455f746f71ad94fd7df6fd076178b9f4fc4699b362364fbabcf37cf53c0162ec4b9b2c16f66d19aafe4eddfe6bda4c20c773d38999
- SSDEEP 1536:uaVHLIjVloPUn4iwODWFic2T0wPijla3bwm+4JfsSF/t:uaVHLIjVuPpi/6Fi9T0w8a3bwYE+/t
- TLSH T1EE833A35B2E2C477E1B62B7C8C124598982E79202E35611E77D50F8C2D79FF46E283A7
- MD5 SHA1 SHA512 SSDEEP TLSH