33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe
Size 92KB
Sample261002-ftvcfszyfv
SHA256 33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661
MD5 1f0fe0331139f8cc651f1b44e13879e6
SHA1 942bf5cbd84204d1425450b27fa624c9714b750c
SHA512 0755fb647e1e1a4cf475b6ba3a2bf2234f96033671d282a77facb4525bcffd4f4a376d8999065b2b4af8a419fa6dda7ceb07130e3d31f77ec32ea85898104ed5
SSDEEP 1536:s5neEhlcTW5sk1Ptf2XbWINndFPTys5g1HSXCaWX3o6xjgPzj63m41d0R:Knj9PtfUKINndFPTb52ySZX44jgPzr6M
TLSH
T137935C1297E5813BE0F527B059F912A31779BCE06F78A3AF824915D95C717C0AA3832F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	server.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2940	server.exe
2940	server.exe
2940	server.exe
2940	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2940	1320	jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe	88
PID 2940 wrote to memory of 2348	2940	server.exe	79
PID 2940 wrote to memory of 2348	2940	server.exe	79
PID 2940 wrote to memory of 2348	2940	server.exe	79

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2348
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_33dd43fa4d96ddbfb167ee204c864586150e115579c9cc67964e6dfde5e40661.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe
Size 31KB
SHA256 3142300fd9d76588021c94b66ff9a3cb7ae3ab8fb4e74eb346d5d0a90db8f568
MD5 4692f33131c035e8cd54d30d0a8ac78d
SHA1 325c9dd237d7654c54342bd348969b1d99bee7a1
SHA512 7cbb7dc20b8810d1f4f1c1920f2a35ef946e6f838f38bc434282a091646279566a96a42cebbb7b7a086745aac13320b35933400fa6ebd05ab783fd3f0e3698cf
SSDEEP 768:Z+h7TzTBziifTeiZSVWihwEknh0L7OTLeNfQfA:kZ/nEkh8OTKNd
TLSH
T1AEE2D14911DB18D0E593FA788DED0EF591E44A319F67030B93BE90FD5B61A43249D0CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-0-0x0000000001000000-0x000000000101A000-memory.dmp

Download

memory/2348-9-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/2348-10-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download

memory/2940-6-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2940-8-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2940-14-0x0000000010000000-0x0000000010013000-memory.dmp

Download

memory/2940-13-0x0000000000400000-0x0000000000409000-memory.dmp

Download