Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 09:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe
- Size 32KB
- Sample260930-lrvs4avt2j
- SHA256 dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754
- MD5 fb8ff17ce504353c14c47620b6ce8654
- SHA1 204d84a705c1281151886c171d7e3523e9a1eeb5
- SHA512 a305a77919def0746c2344e9ef4ca03ede8e51a5a9b6a463d524bace288972f1e30ad4995712dc3343f68d47ca86b09d7a2c382d9151b9b3448eb5494a5561c0
- SSDEEP 384:0zWTSVGjKynKmBs8QR8Z6LxDA1nnUHr0Rbjxtms0tg1EYn1hz/om+vnq9LQmYydj:DTLpnxBqL1SneEffEY//4G3s4YuAR4
- TLSH T145E24C1B6764C6B0E6541034814F6B7BBB2E28B99F9136D3FB807E86B879AD0943C147
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\some = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe" jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe - Executes dropped EXE 1 IoCs
pid Process 1672 wcm.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 1672 wcm.exe 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4864 wrote to memory of 1672 4864 jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_dd5dd78d6a96df33c3d32054c38cfdf81e46030d103de1a12a3607ee4d775754.exe"1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\wcm.exeC:\Users\Admin\AppData\Local\Temp\wcm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wcm.exe
- Size 7KB
- SHA256 801aff6cc4e31e9c616ecda6fab04900ad82e787c3ebae55634131d8678c490b
- MD5 eff4c4ef8c8b015126abe5d8615b11be
- SHA1 a1c896cebc5378d61133fd6330407fc3c27a07b0
- SHA512 0e93ecb1dc1821391c00d50aef97a1ded39ebec5ddb7f0c34d2090e50cc7a97b9e1f6298f26febecbb2e9164baefc8736c8ed7ec7cdb06f40ac6b8b9a672d6be
- SSDEEP 192:hPnd8a4SUBnfGHUM8KjHfaJOyds0kv/v:dCahAbKSkXv
- TLSH T13AF108135F90AFA2E78474B8114F5B7F593E64BA8302B9E3F78014C558751E1E838293
- MD5 SHA1 SHA512 SSDEEP TLSH