f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181.exe
Size 738KB
Sample261002-jmwtgszvbz
SHA256 f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181
MD5 4c729ab4b6ffc6fb899a373c089d3408
SHA1 cc59d915734890fa95af10459077384a897142c0
SHA512 0ad2921933a3360b8124e2afaa011f7fc39b65aef6f0b9f438b064bc230cfc096152d871361af7e6814997cf92f5d03543e91870ddfdde4569c68ca75c5daa99
SSDEEP 12288:z5DUbx3LcdG67fkp2MgU7gAFD9T3AeAPwkPUUC+stVpzvXRqqFqqFqqJwg:z5DUd3qvzLdYD96rPUast//RqMqMqRg
TLSH
T1EFF4AE51A6EA4A44F5F63AFCE6B94931092FBD61B834ED6D0270702A1B329C3DC2175F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2716	4104	WerFault.exe	87
5844	4104	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f94de3154fa088c0d90897fb436524461de094db19498ac93c46b7b0f7bc4181.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 332
  2⤵
  - Program crash
  PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 340
  2⤵
  - Program crash
  PID:5844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4104 -ip 4104
1⤵
PID:3728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4104 -ip 4104
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4104-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Download