df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Size 2.0MB
Sample261002-emvtzas17p
SHA256 df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4
MD5 d52e0025c90d8b135644526258c82f60
SHA1 8ee05401392b40c31e93481f47d797ad5cd345a4
SHA512 1f437b48085b2332eae88dbaae610b298edbaa761e57ad24ea209bcc3c5c08606f8beceaa7e495716c8dea24d515076327f3aea670ffd67ff301f1ecdcb21dba
SSDEEP 24576:Djb/N/H1RQlQ0yfWlW0PuHwAnT5llPrOyXtDePVOIblCVnF4wLIMgKsksW5AmUi3:Dj5/1RYxUWlWwtAwatDhI8b2MgKszrz
TLSH
T1D0A50231E7918433C3772A799D3BA29488297E103D19944776E95E4CFF3A28239363B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

ConfuserEx .NET packer 2 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/memory/4452-9-0x0000000000400000-0x0000000000434000-memory.dmp	ConfuserEx
behavioral1/memory/4452-13-0x00000000054C0000-0x0000000005566000-memory.dmp	ConfuserEx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4880	4452	WerFault.exe	84
3628	4452	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000090000000	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4452	jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_df90047c88eac2a616cd6ceb74ae7af2ab5d98fb9d58627530143d5db3c75ca4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 140
  2⤵
  - Program crash
  PID:4880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 152
  2⤵
  - Program crash
  PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4452 -ip 4452
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4452 -ip 4452
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4452-0-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-1-0x00000000004C3000-0x00000000004C4000-memory.dmp

Download

memory/4452-3-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-2-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-4-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-5-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-6-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-7-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-10-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-11-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4452-8-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-12-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-13-0x00000000054C0000-0x0000000005566000-memory.dmp

Download

memory/4452-15-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-17-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-16-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-14-0x0000000007B30000-0x00000000080D4000-memory.dmp

Download

memory/4452-21-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-20-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-19-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-18-0x00000000080E0000-0x0000000008172000-memory.dmp

Download

memory/4452-22-0x0000000002F60000-0x0000000002F66000-memory.dmp

Download

memory/4452-23-0x0000000002FF0000-0x0000000002FFA000-memory.dmp

Download

memory/4452-24-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-25-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-27-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-33-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-32-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-31-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-30-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-29-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-28-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-34-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-35-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-37-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-36-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-40-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-39-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-38-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/4452-42-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads