Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 13:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe
- Size 732KB
- Sample260930-qbvwdaxt8j
- SHA256 f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc
- MD5 c5b6c87d7ff3b1cec4e828b974292b96
- SHA1 9f7e7ce8d8447211202aea061688cb55db2f0edd
- SHA512 a4469e98fd136c43a6f2f5d0a351baae2ee19cdf07a32af1a346d151605d1a58d29851996bb513cb075dea4792b919350dce0df9751ea5003d2f79d3e999bcc1
- SSDEEP 12288:DcblQCktRABVJCgs32TrEStRHwa8NQtI1Q+T8zqDQc+dxA+Ps3Jvt2:DcxtkfkJCp32TZtRQRh+d2+PIt2
- TLSH T143F47D22B6E1C437D5732E749C1F82F99836BE106E24B8863BE52D0C6F3865179253D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings OpenWith.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe 476 jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 OpenWith.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f981921de4c93a8c226bf168e20d668099e061c95750d8c9f563d1e43138c2cc.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:476
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\36348364
- Size 16B
- SHA256 c8b9f348c8635d7ffcd5d16ad4b9c65289302dc6c4fe2e0210346b23013fb280
- MD5 2c2dae9e9cdd73404ecdd9db22102374
- SHA1 ea677e87b386c2846decf8c84e807f659923139a
- SHA512 1232579f39b9ca5f79f272dd7661eaa61fc309085007175539e078928757370ed4114a67895d9ee2ef9bf90820a29b1053e35a8b6182dde1dede9910f030e903
- MD5 SHA1 SHA512