e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Size 56KB
Sample260925-wvyn9stakd
SHA256 e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892
MD5 36852b2f4feeb12af5319ea16d86fb8c
SHA1 f95c27816ed8bd20bbb729ff672fa6071a2c39fb
SHA512 55d7725596177ff26d55b06d53f2ede1b0e01029d9cae5a2042e0a342c639f2923e431c4f2f0e560e68c057fea1f21e31c5f28dadb0462e0fbea57fcb1e457e5
SSDEEP 768:AI7H98lANI2Qf7Ww/Kq9xZ0779VfsncnZFih/GM72rsaldPtT51QGdK:AI7lNI2yWUtY9VX4OM72rsal/T5114
TLSH
T1A543D087F70A4524C0A20B7614CF772AFB7C57391157EB9A232B6A8AFDE14D1390D741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	Rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	rundll32.exe

Loads dropped DLL 7 IoCs

pid	Process
4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
1244	Rundll32.exe
1244	Rundll32.exe
1244	Rundll32.exe
2956	rundll32.exe
2956	rundll32.exe
2956	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DLLCACHE\VERCLSID.exe	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
File opened for modification	C:\Windows\SysWOW64\VERCLSID.exe	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E25C29AB-12B9-4523-A53C-324B5FBA648C}\InProcServer32\ThreadingModel = "Apartment"	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E25C29AB-12B9-4523-A53C-324B5FBA648C}	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E25C29AB-12B9-4523-A53C-324B5FBA648C}\	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E25C29AB-12B9-4523-A53C-324B5FBA648C}\InProcServer32	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E25C29AB-12B9-4523-A53C-324B5FBA648C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dat5961.tmp"	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
1244	Rundll32.exe
1244	Rundll32.exe
2956	rundll32.exe
2956	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	Rundll32.exe
Token: SeDebugPrivilege	2956	rundll32.exe
Token: SeBackupPrivilege	4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
Token: SeRestorePrivilege	4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1244	4104	jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe	88
PID 1244 wrote to memory of 3844	1244	Rundll32.exe	81
PID 1244 wrote to memory of 3844	1244	Rundll32.exe	81
PID 1244 wrote to memory of 3372	1244	Rundll32.exe	90
PID 3372 wrote to memory of 2956	3372	RunDll32.exe	91
PID 2956 wrote to memory of 3844	2956	rundll32.exe	81
PID 2956 wrote to memory of 3844	2956	rundll32.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3844
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e2134c3d7b4c53d2f4f6c6e1f9e88747eb536df60d5bf58915e139dcca221892.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\Rundll32.exe
    "C:\Windows\system32\Rundll32.exe" "C:\Windows\system32\shell32.dll",Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dat5961.tmp"
    3⤵
    - Drops file in Drivers directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\dat5961.tmp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\dat5961.tmp"
        5⤵
        Drops file in Drivers directory
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dat5961.tmp

Path C:\Users\Admin\AppData\Local\Temp\dat5961.tmp
Size 9KB
SHA256 6f5c5c7aa05d280ad1f731fd4304be1806c25fda74a4b4fb6607436e25cd6c40
MD5 f33a8af58db83477382ce882c710479b
SHA1 f5d8321f940509ef048e0effcb78e8657396f2ca
SHA512 f3222844cab8ae48654f0e5a7ff4f9a18a9baca33c7dac76f516fa9eb7bb02e480a2d8afd62a077671a47e9bacac67474c8f761ceaeb62b8107491a493e878be
SSDEEP 192:BjzUZXTsW3l0vdV+WcJwuLQFXQynPnrbdMcCivZJzJ2K/xvHwaD8GjpJS:VzUZX72vDnswqQlNnPntMcCAH8K/dwak
TLSH
T11422BEC7EA2F9628E8658E3B58C7D70BF9B9DB01286B9F7100462D9DFE507C33198406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dat5962.tmp

Path C:\Users\Admin\AppData\Local\Temp\dat5962.tmp
Size 22KB
SHA256 834592d6a00e10e39d05d1e011ec7c06b90096133539cf68ba8128d34c49ba50
MD5 a45b34a0c694d93c6096e117c872edfa
SHA1 a7eaa0387d94a521e310aa2871f2d77dd164284d
SHA512 62f9b9ccd354b1ee6e8239c8b2bd9c69aa8914b617e6582d5e05cf8bc2e1aed47ad420e9ac87effceb918b99eb44567249131dec36a16b8c53d539b326353e1c
SSDEEP 384:OV2vD0nf7jm9wEzIxTAFqyxgxZLA779MgtKKDjsWKvcn2U3NvPBFih/GJ:62Qf7Ww/Kq9xZ0779VfsncnZFih/GJ
TLSH
T165A2D09AA24B0118E0B20BF670DFA771F32C633C004FEB1E115C9A89F6F95543D4E865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dat5B45.tmp

Path C:\Users\Admin\AppData\Local\Temp\dat5B45.tmp
Size 6KB
SHA256 5d9dbe2a6f30f9b84f147ef0b3b990e44d634a29d7191f5185f48b5526cb9a52
MD5 69d308d862fefa4548d87545b387dda9
SHA1 d90212298fe2cdd43529621a4a5bedc18895af83
SHA512 02d80329ddfa00fded86aa519af6e52dfc42f7d0e1f43cdb05d2f32addf37010b0bf5789a266b68c04b92a1514e218a6e4554ef2bdd550c2d25ef60a28d6f2ed
SSDEEP 48:qEB8WxFyqd85cpizNlVEKmDm5dW6aifh51Ma+Uy0gFzZqGsTclboIVTUnoIssl7F:WWxFkDJAidW34KvAgzqJTk0GIPZ0v
TLSH
T169D1E9039321A0E6C1F65EB49CE3B058163E2B7D0340C6AB2EEC56129DBD146FF2126F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-19-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/1244-11-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/1244-12-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/1244-20-0x00000000027E0000-0x0000000002801000-memory.dmp

Download

memory/1244-18-0x00000000027E0000-0x0000000002801000-memory.dmp

Download

memory/2956-22-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/2956-30-0x0000000002430000-0x0000000002451000-memory.dmp

Download

memory/2956-29-0x0000000002430000-0x0000000002451000-memory.dmp

Download

memory/2956-28-0x0000000002430000-0x0000000002451000-memory.dmp

Download

memory/4104-6-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/4104-7-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/4104-4-0x0000000010000000-0x0000000010021000-memory.dmp

Download

memory/4104-31-0x0000000010000000-0x0000000010021000-memory.dmp

Download