0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276.exe
Size 103KB
Sample260930-mds8sace44
SHA256 0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276
MD5 48236262a63211edd2b5c53306de664d
SHA1 e2d8ee7c15fd3d802e5ceb8d76c70743367d6af1
SHA512 a31d95cdc8fa56ddcbe3bc82fe89f7df4bd5382d459725b4edb2af110ed92170f8c0bee0a058e6b246cd4859ccb7eadd3e49ebe9c016b5e0e20fecfe8ea4e744
SSDEEP 1536:pngs8PVQDvubQB1b/i7NWtwfBY8nQQHAlP6cSaB99oWmUqNwvpJ5r:UimbQB1wotYrQiAZ6VaB/tvpJ5r
TLSH
T171A3E03763909DBFD8B3973486AB0DB2DE2637212267173F0156E50C2AE7D96AF05B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1144	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0f0c963dea492e965c1e7b099ce2cd24c2525784b2ffb347d24136617b218276.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 420
  2⤵
  - Program crash
  PID:1468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1144 -ip 1144
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-0-0x0000000000590000-0x0000000000592000-memory.dmp

Download