14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f.exe
Size 1.4MB
Sample261002-gp2reazfqa
SHA256 14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f
MD5 55b4aa7486f6b37b1ef8dbe9eab62fe3
SHA1 d6fa72304996d7bd32e36f3d8538a323026dd057
SHA512 b40440e94fe0cbf62efdc0d5b7abac821c79a4a0223637f039c0041e26648e5133f348ea6b39e06d8c3e50ded2fce29b2d35ede169ddf3854b372d9e2825c76b
SSDEEP 24576:CbUo8hRstaPDWd4Ztt9oSO9ynOTpR4q+Ztt9oSO9yd6P/KB4t:CbGSWHtO9yCRKHtO9yY3KB
TLSH
T10465D037A2A3C472C1A75A359D0BB3B81931BE5E6FEC68872BF45D0CDE352813835295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
3548	TVwrd.exe
5344	TVwrd.exe
3536	MiniConvert.exe
5300	MiniConvert.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Temp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp.vbs"	TVwrd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Temp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp.vbs"	MiniConvert.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3592	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3548 set thread context of 5344	3548	TVwrd.exe	91
PID 3536 set thread context of 5300	3536	MiniConvert.exe	99

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001b7fd-6.dat	upx
behavioral2/memory/3548-8-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3548-10-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3548-11-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3548-21-0x0000000000400000-0x0000000000470000-memory.dmp	upx
behavioral2/memory/3536-33-0x0000000000400000-0x0000000000470000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1136	cmd.exe
3856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TVwrd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MiniConvert.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3548	3916	jaffacakes118_14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f.exe	90
PID 3548 wrote to memory of 5344	3548	TVwrd.exe	91
PID 3548 wrote to memory of 5344	3548	TVwrd.exe	91
PID 3592 wrote to memory of 1136	3592	WScript.exe	95
PID 1136 wrote to memory of 3856	1136	cmd.exe	97
PID 3856 wrote to memory of 3536	3856	cmd.exe	98
PID 3536 wrote to memory of 5300	3536	MiniConvert.exe	99
PID 3536 wrote to memory of 5300	3536	MiniConvert.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14ae31c02bb6f1202f86343280b9e39109ad74f651c16926c99835d8e58ee37f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\TVwrd.exe
  C:\Users\Admin\AppData\Local\TVwrd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\TVwrd.exe
    "C:\Users\Admin\AppData\Local\TVwrd.exe"
    3⤵
    - Executes dropped EXE
    PID:5344

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp.Bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\cmd.exe
    cmd /c """C:\Users\Admin\AppData\Local\Temp\MiniConvert.exe"""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\MiniConvert.exe
      ""C:\Users\Admin\AppData\Local\Temp\MiniConvert.exe""
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\MiniConvert.exe
        
        "C:\Users\Admin\AppData\Local\Temp\MiniConvert.exe"
        5⤵
        Executes dropped EXE
        
        PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TVwrd.exe

Path C:\Users\Admin\AppData\Local\TVwrd.exe
Size 162KB
SHA256 572c2dbb47e23ea4470a2302ec8a5886b314fffe2dd8129a10038c32ffd1a3f5
MD5 53f2a9a3ab9c338e4ed2a100f74e2f33
SHA1 e74fe1ecdcefac96e9e8cc8b7466a91ef8e3e9bc
SHA512 d113ec6147173c59f4685714e60c343fa4b5fd1e21d9c022ff0a597e8fd7e7900ce0667b4d9313190dfdf101f24d7f7a9581e931a461f768e8a3dcdc38f1bf9b
SSDEEP 3072:KfXdc4Hs15AXjiXwbtzGmp+WS/QKUCel4xs8GoBmSh:KfNfM1yXjiXWGTYKgixsDocS
TLSH
T1AFF312D9BBC99753C18E9235486AD119812FE473C72647C35222FF2F2F3A213289DA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Temp.Bat

Path C:\Users\Admin\AppData\Local\Temp\Temp.Bat
Size 63B
SHA256 1d9e8d519a380d16e38aea04ee2743d9c812d1fa527ee1e62a8c8e1bdd5b5109
MD5 50b6913dfa206f80c45836f342c5b9b3
SHA1 ca6f301d7a2a5b3cf78dcf68faf670ec53340f03
SHA512 3a23362cb3cc0250f91342197f47dad2dd2fdc56dde9d735bd719f5ff6f6f865937223b4af3af43f6cc3bf2ed910ec557bda90b7e61a3dcf3bb69eec4f815022
TLSH
T15BA00212818F8F1E4545741B1571924DA3612C4C7EE62F708E10C428515142DA6D6341
MD5 SHA1 SHA512 TLSH

Submit Download

Temp.vbs

Path C:\Users\Admin\AppData\Local\Temp\Temp.vbs
Size 130B
SHA256 2acda24b572f07d8145b5e8766e852163bac19c08d5270412412667ed20721be
MD5 842c1ec319b90c507a8783eb4d7f65ac
SHA1 3d990449747da6c8f4f702e35c2130724985bbe8
SHA512 3433a89232058102db39127e756b01e8513c65c6e46496c9f54d40566dc186bb7e80d7e24778bfc7f0a312c9982197b8137a256fd4f6bf87e8062e3bc5fa0825
TLSH
T191C02B1BD883CE2C130000870E32904C0DD0241C7A868F30CDE0C8B810D35591B49943
MD5 SHA1 SHA512 TLSH

Submit Download

Tm.bmp

Path C:\Users\Admin\AppData\Local\Tm.bmp
Size 335KB
SHA256 d2f49b0d8583969a9a1252cf63a1bdb177dda127970cefef218cbc6aad775b29
MD5 57c3d466698d5cff759359946ad2923d
SHA1 4878cfd677014e13102b21037ab7240296c37a2a
SHA512 cab7ad012b26e84131069d6c2e322b936e83d164e0b1aee68dbec392a13a5849b7e74644cc6d1f7aa6f3cf88ad999edc913da9807357d2990305d884d9ceffa1
SSDEEP 6144:kZrCkzdDS2N6g8lRlStA9ynOlJpQnA4qOvKZnuxIFg9p3:kZ1zdDSW6gobSO9ynOTpR4qzZnc3
TLSH
T15E74E104654BC6F6F1EBD6771D8A83B912315A9BEF6098C73DF5974A21230D43A20FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3536-33-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3548-21-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3548-11-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3548-10-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3548-8-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3916-0-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/3916-7-0x0000000000400000-0x000000000056B000-memory.dmp

Download

memory/3916-1-0x0000000000469000-0x000000000046A000-memory.dmp

Download

memory/5344-13-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads