0cf283c79a51df069059f5b75c64d7f2108f890762d2c998ecfc90742218b39d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0cf283c79a51df069059f5b75c64d7f2108f890762d2c998ecfc90742218b39d.dll
Size 201KB
Sample260930-mm2lhscf73
SHA256 0cf283c79a51df069059f5b75c64d7f2108f890762d2c998ecfc90742218b39d
MD5 8b00047e2dde62b918a618087e266342
SHA1 5b37b0c8d83a62ac2ed86b8baf2b4ff4390a004c
SHA512 efce2b17d3cabef2b9b97182ce96139beaeb8318fc679a4791ffc23f0c1a410b06adacb6e1b1f52524671872fe46928b93013b6b62806770e781d057db811a78
SSDEEP 3072:jJZQQJv4ljtC0aCZaPjjkFE7fsitQWeyjrfDRDEwbgtR65GWTUea7CNgELH:NZ6JC058jjjp/bRDXgtRuTA
TLSH
T185146D36F1D08937D0B61E7CCE97A2E5755ABF602D3C150F79E80E4C8A3A2D269193C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2428	5928	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 5928	2444	regsvr32.exe	89

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0cf283c79a51df069059f5b75c64d7f2108f890762d2c998ecfc90742218b39d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0cf283c79a51df069059f5b75c64d7f2108f890762d2c998ecfc90742218b39d.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5928
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 576
    3⤵
    - Program crash
    PID:2428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5928 -ip 5928
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5928-0-0x00000000021C0000-0x00000000021F7000-memory.dmp

Download

memory/5928-1-0x00000000021EF000-0x00000000021F0000-memory.dmp