fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b.exe
Size 320KB
Sample260930-mhmlsszckc
SHA256 fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b
MD5 fa0be9a233d2ded2d0986b501353666e
SHA1 38be041232177354316e8f91878be2eb6d50a1ab
SHA512 26d2dabcc6e585ee728c21a45859263b4d257e34e1288273c61abde94da3819bf29444161ac3b488476bac9c83c8c46c9a06ef5fa6ced48dd2eaead1a7b4ce32
SSDEEP 3072:tMKxnMDXJiEt3K5+yrqW52En3mE/WsacFiB8LTkUYkyYqQwpqIkl+zOBtM:tMTEYW573b/WsaTo4dO
TLSH
T1AF640952F694CCA4F4C7117BEC7AD4F01123BE8DE4114E0B259ABE2AF67235391A790B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5400	3676	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd20a3cb488a7455bc318fc8a1a3ccd697cd9719dfa2b5d720a602e60dbcfd9b.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 292
  2⤵
  - Program crash
  PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3676 -ip 3676
1⤵
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads