00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Size 152KB
Sample261002-gprlfaz18m
SHA256 00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be
MD5 176f79fa685bdc203805a95411e94e45
SHA1 991fbc230010b53e06cc6c771759a62c01e21107
SHA512 0a690c7d8f00ce8bc7b1b555a06e27a620db83831152e4d30dc22cd27494443e7aec67b31698bc38e8302127300446a22ddcbf2f412942f6a5d099bbf943b1b4
SSDEEP 3072:Aee0YoNVD6AbYtFKi9RwDJfwLyFDQShMUCR:AexNY8ji9RqJiyFHCR
TLSH
T137E348AF3A28E075E5AAECF5435351AEE5C1B455ABDFA3D38B023817C7219D210321B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5052	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau\Impersonate = "0"	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau\Asynchronous = "0"	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau\DllName = "C:\\Windows\\system32\\icmuwmau.dll"	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau\Startup = "WlxStartupEvent"	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\icmuwmau\Shutdown = "WlxShutdownEvent"	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\icmuwmau.exe	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
File created	C:\Windows\SysWOW64\icmuwmau.dll	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5052	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
5052	jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00977f6d49de5e1700d949e042e72f7377c0ae22aa1a1b1062d168dfd86f26be.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icmuwmau.dll

Path C:\Windows\SysWOW64\icmuwmau.dll
Size 112KB
SHA256 d2410d229605e667b7374a79741d7ba79a68efcb41896bf2b097557d2c1c6905
MD5 9cdde4a0f23cb633f7c829afd9ea2589
SHA1 3b9624b0f46657669f02c0e3f59c700e6a3ed4d9
SHA512 ae7dded2b69161b7197f08c2fa3db6662cff934c0f8cac561c1095fff391d5729aa9fc16669c0b629c819e62b07678ca02303c09d52225d0ce0454222a70ab1e
SSDEEP 3072:nCnlxDgB92t4GLQ9WPJbst3jwIUgnuSE0loB8r:nCnLYy4ixPJ4FjDm0WGr
TLSH
T137B3F1C8F7FC72F4C8166C31818D1D6BCB78B12A17A9A9E35F136D829A325F76432245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5052-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download