f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
Size 32KB
Sample260925-xa6d2sgh36
SHA256 f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb
MD5 842b8bb00eed13eead71158a134ff18e
SHA1 91b2d47a5e5dcfd45c2128d2771105ce886e518d
SHA512 4894babf8f5d40a116820533480f2a0d178e7f8dc3153a2f17ed2471af90e8983ba5c3971523b596769adb5318de2fabb4833927569fd7e43dcb66a76e3fe537
SSDEEP 768:UaCFBsbWjNUFCfIwTfHAi+QPnvsJBxHROvt:n+BfFT+BfOV
TLSH
T144E22C0A661980F2D3E9163431660F3B8FBE98787BD8B5D7C773C7C558B4252A63920B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4604	MsIMMs32.exe

Loads dropped DLL 2 IoCs

pid	Process
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4604	MsIMMs32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MsIMMs32 = "C:\\Windows\\MsIMMs32.exe"	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MsIMMs32.dll	MsIMMs32.exe
File created	C:\Windows\SysWOW64\MsIMMs32.dll	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\MsIMMs32.exe	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsIMMs32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4604	MsIMMs32.exe
4604	MsIMMs32.exe
4604	MsIMMs32.exe
4604	MsIMMs32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
4604	MsIMMs32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 612	4916	jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe	82
PID 4604 wrote to memory of 612	4604	MsIMMs32.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:612
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4916

C:\Windows\MsIMMs32.exe
C:\Windows\MsIMMs32.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MsIMMs32.exe

Path C:\Windows\MsIMMs32.exe
Size 32KB
SHA256 f825054b5c040a9777ded3f1afc80320011cd35e59a484f1dd23b23c6eaedbcb
MD5 842b8bb00eed13eead71158a134ff18e
SHA1 91b2d47a5e5dcfd45c2128d2771105ce886e518d
SHA512 4894babf8f5d40a116820533480f2a0d178e7f8dc3153a2f17ed2471af90e8983ba5c3971523b596769adb5318de2fabb4833927569fd7e43dcb66a76e3fe537
SSDEEP 768:UaCFBsbWjNUFCfIwTfHAi+QPnvsJBxHROvt:n+BfFT+BfOV
TLSH
T144E22C0A661980F2D3E9163431660F3B8FBE98787BD8B5D7C773C7C558B4252A63920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsIMMs32.dll

Path C:\Windows\SysWOW64\MsIMMs32.dll
Size 23KB
SHA256 7cc1af944d23f2880c0a3b9502960cbdf5331d91ff73839d3566d936c183300d
MD5 c21e7a9aa916e79bbe21961d2bda9c89
SHA1 c9a7914452730e2807f21fd2a777284dc6eb2eca
SHA512 ceae0f273042222d63856880d7f1ff26d83f7e5f83754245d95714f87aa89e225452a27532b2399cfbc92098f5315dbe264fd72bc6b86e17b05b3fa5f196fd37
SSDEEP 384:8FmRfIzrXgNofhSfae1Oi+QGZinc909fuH72sjASAOHmWVfo5vo:8FCfIwTfHAi+QPnvsJBxHROv
TLSH
T163B22B1A661980F3D3AA1334705A0F378F7ED8787EE8A287C77347D56874262D67520B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-1-0x0000000003720000-0x0000000003721000-memory.dmp

Download

memory/4604-14-0x0000000010000000-0x000000001000A000-memory.dmp

Download