c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
Size 686KB
Sample260930-l1daeavxcv
SHA256 c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707
MD5 492c0592f3a25898373bc61e002e753e
SHA1 d240626e274c05b55d35227109b7b7b5f3d3b947
SHA512 42fe4e5a49c968166e795609a8162bf2692ab24771b98885c6164268a7efd55fc4fb4eb5ef99a9ae59ba53de7338fb876e5e0c9d357fe0269209fd1513f13cb2
SSDEEP 12288:vnes5gcFZCfgK8D7N4/h5Wphn2cz3V0w72RQIb:ves5gerXN6I2udy
TLSH
T146E40263DB0787F6D2B875F90A8F4B164A3869C40362190383BE983662DF77570977AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence upx

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1852	lM01815GmHmL01815.exe

Executes dropped EXE 2 IoCs

pid	Process
1852	lM01815GmHmL01815.exe
1400	lM01815GmHmL01815.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lM01815GmHmL01815 = "C:\\ProgramData\\lM01815GmHmL01815\\lM01815GmHmL01815.exe"	lM01815GmHmL01815.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lM01815GmHmL01815 = "C:\\ProgramData\\lM01815GmHmL01815\\lM01815GmHmL01815.exe"	lM01815GmHmL01815.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5856-17-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/1400-33-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral2/memory/1852-34-0x0000000000400000-0x00000000004C7000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5724	1400	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lM01815GmHmL01815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lM01815GmHmL01815.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5856	jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
5856	jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
1400	lM01815GmHmL01815.exe
1400	lM01815GmHmL01815.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
Token: SeDebugPrivilege	1852	lM01815GmHmL01815.exe
Token: SeDebugPrivilege	1400	lM01815GmHmL01815.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 1852	5856	jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815.exe
  "C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815.exe" "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815.exe
C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 232
  2⤵
  - Program crash
  PID:5724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1400 -ip 1400
1⤵
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lM01815GmHmL01815

Path C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815
Size 192B
SHA256 9552da0a996481e7fddc8038a5ef311c1bcb1b16a53c6c3d667baef2a0bbcc4c
MD5 408a429deefa00c01fe2664d75931e46
SHA1 44c7bc5f004d40606d420d0c73e39d1ba1ea2ac0
SHA512 edffb36edbf587c8bc647ddd83626cab3de796cafa35eaa9d5cdb5bf26d0e486f811f2e8ce6a7201e9078e0a4bef30a2912bc47c649aa3da09e892ba7c4e03e6
TLSH
T11DC01224CF1762AEF1823D77F0B7D001F190DD5B18E640D80CC341D04125551A142795
MD5 SHA1 SHA512 TLSH

Submit Download

lM01815GmHmL01815

Path C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815
Size 192B
SHA256 0a6d856b80b8b75e12fb7d6d4593f5b2a878376255e739ff3497f736018e28af
MD5 fab8e9eec3ddb5b3e593f3667a60f543
SHA1 e8622d871d498f4dfadc58de79d935690c5de919
SHA512 c99c0f4a02e4b33da8059ea6e7cb8e2aa7704842d1ae2cb2316a2b2c68336fa2e95f8359d11074f0029db761291e8a19011a99ae17b86ebc2b7fda8016bb376a
TLSH
T1C6C022C82B082E188A36BCA71014AA385B71ED0D0088C1A8CC1EB530282FAA42098858
MD5 SHA1 SHA512 TLSH

Submit Download

lM01815GmHmL01815.exe

Path C:\ProgramData\lM01815GmHmL01815\lM01815GmHmL01815.exe
Size 686KB
SHA256 363036e3bbceba1f8eee365037ba6ef1778a77ffa469f2e97ae7f2ccb419537f
MD5 5406b7da33eb48f9bd1e0a5c1f7b9bf6
SHA1 262e915b4c20bed396110da9e2fc67e9e6adbeaa
SHA512 25867bbbcf3c2bb52f48dce6a6d1da4df6208b2fe4a512fac4c5e937b903f6c6499e9662c413873e48454631a966feb1afe05e63665170b8b2357b99df5c1c68
SSDEEP 12288:Anes5gcFZCfgK8D7N4/h5Wphn2cz3V0w72RQIb:Aes5gerXN6I2udy
TLSH
T118E40263DB0787F6D2B875F90A8F4B164A3869C40362190383BE983662DF77570977AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c40695c13d5f3e8ed58904b00dfa7ca8856ce8bce399d1677d77bc9f80ad4707
Size 192B
SHA256 8c966f7beb9afef5d20bdba4ae04ae20e8c5174fdb7b3fbcdeb271ffc3283a92
MD5 a34469984241af4a902e843a357a7ec8
SHA1 4a59942ca4d4cc9830fc1cd27c72453f389bd2fd
SHA512 c8a400a58fe7eb90d66c15e586a6d41b55b8f4067c707a779a217211d0c5e25976fd785f6ff02d873a759d5d45f8a641f5c935b1cc7230bfc61a328a899c4485
TLSH
T128C0222238198B02C848C2373340FC9ECAD9381240DE00C02A0762996C700880AAC305
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1400-33-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/1852-15-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/1852-16-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/1852-34-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5856-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5856-17-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/5856-3-0x00000000028F0000-0x0000000002943000-memory.dmp

Download

memory/5856-2-0x00000000023D0000-0x0000000002476000-memory.dmp

Download

memory/5856-1-0x0000000000400000-0x00000000004C7000-memory.dmp

Download