Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe
- Size 29KB
- Sample260930-msrnhada23
- SHA256 9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417
- MD5 8d6aae57a47e2809f3c9f60e83ee5498
- SHA1 b98b885278b644a84a39b28ecf970bb5dc83fcb4
- SHA512 476adc67a667281238575055874a641734c6aaf321c7f05133ef37726557b497205122ea4b18a8d6f422cf8caba70d29c2c250f84164bd572cc4f35ef675f560
- SSDEEP 384:QYdk4iqsu3AjwSeauQPmILw4GjMiKy2PElQxyzqofN32eBrTdKGYyi37sFKD5aux:+qlQ0SAimP48Mi4ItN328TdKGks5s
- TLSH T10AD22918BB508671D86A4830E49D633677BE8CB65E4550D3EFC1BEC5F8B86E1A43C287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\smile = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe" jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe - Executes dropped EXE 1 IoCs
pid Process 2456 wcm.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wcm.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 2456 wcm.exe 2456 wcm.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4852 wrote to memory of 2456 4852 jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9e9c35291296e0ab0741ef89a7eed55886385111c70c73a2a05a7d8445778417.exe"1⤵
- Adds policy Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\wcm.exeC:\Users\Admin\AppData\Local\Temp\wcm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wcm.exe
- Size 6KB
- SHA256 dc6655335a2c25937c62f16df784ece80462305290a65afa172f958f2c5a4184
- MD5 9fc7b31f6d3498fd5396a2664ec6cb51
- SHA1 8f983d106d8aa5e118f51c1907816909ba7b53e1
- SHA512 9cf9ff1bc26c55cf7ed3f2446dcf3cd8f2b5c2ee75124f1f0a9c1bf820afa7794572ca4e0e634ad061ff3c3f6f0e5195ad0157bc0ccc41b26ab4e07a20de0e01
- SSDEEP 192:VKJVJqJd3Yyi3HSaGfFKdKqPW0f75auoMg+/y:VKGYyi37sFKD5auoMg+
- TLSH T130D10A29FF4042B2C39C483564A6552A63B8D4731395B4D3E7B7D4D4ECBA9F2303C682
- MD5 SHA1 SHA512 SSDEEP TLSH