67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a.exe
Size 1.9MB
Sample260930-ln4xlaxblc
SHA256 67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a
MD5 c8baddb87d503d91190788ba52a9d9df
SHA1 e827e282d59b62adfb882257485636972b9ca1d5
SHA512 c9018086d94d9de7d8cd71e30449fdc279969788c31d9ae5dbf30b58aa75cc645b08e3f87c9eb256470c700152de3b0bcab7ef639e80e47c84293dcf0f0300f1
SSDEEP 1536:1iKJyyx/amd8fkFe2pXtHuscxiMeKjx1PB8VIejs+yZO0UK81L2NYSgkHH:1izwaBkoWtOkzKjxdBC9yZO04g4kHH
TLSH
T1E295BE53C9B4E888D7D142333D616B22EF1F6E724B6B67781C641C7B1EBD4A0B316622
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4944	6016	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_67b3a5fcb2fd2ae6279ae2cd84f6746bbe07efb9e7940b6a153a0b05459a457a.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 340
  2⤵
  - Program crash
  PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6016 -ip 6016
1⤵
PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6016-0-0x0000000000400000-0x00000000015F9000-memory.dmp

Download

memory/6016-1-0x0000000000400000-0x00000000015F9000-memory.dmp