6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16.exe
Size 1.5MB
Sample261002-jp48msxeja
SHA256 6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16
MD5 c4d6046bb3adc66aa2b79a4aec5adcaf
SHA1 4b09537235c1cdd575090e48729a93ef6ae241ad
SHA512 d8e5e39f8d0b84caf42bbc8a478cc51aaba3af548bc08b394ced487176eedd80965f03b9d8ff5efe38f66fc89d410aa7203757e1effdf4677a8e478cf90dc9ec
SSDEEP 3072:7CXOAFj6hDyuJ5ilXgEtI6LjMEH2jwqNibRZ1ilM9hTLYKwQKcJ14+QR:UuJIqEnLjNHsRiuM/L8cHQ
TLSH
T1AF7512CBF2F6A072C1353F7196947B09D72FF85104A20E966ECE03695AF30799C72626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4520	4140	WerFault.exe	83
3712	4140	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6ae533ea692b4623c876474d38df7ee6df87ccf1c62ac7a33388b1993be72b16.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 264
  2⤵
  - Program crash
  PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 312
  2⤵
  - Program crash
  PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4140 -ip 4140
1⤵
PID:536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4140 -ip 4140
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4140-0-0x00000000006A0000-0x00000000006A8000-memory.dmp

Download