970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe
Size 87KB
Sample261002-jsv45szycw
SHA256 970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86
MD5 dcd004b01d1a5aec3fdb23a655543756
SHA1 decc48076523e5e848b95ecb318770c8e3b12ca6
SHA512 8b09881712c96f4effcf10b7e8695b4848b0908c91dde0d51969a26b8091493deea268cce1f73c9023f6114775a96435c3336c2d44c595305ed71dbd130923d1
SSDEEP 768:QbcokbWFKNwZeHE6sa/Wrz/uwCBjMbgDRS913cwTZA/pVolvK1ZIQMhjOzjUZuUt:Bok6s63Gw0MbghxSOzjVUml8FYvbp
TLSH
T19F933B317F5066B2E400497925B5A3B1E3AEEE703822EFB2C76419352C395B74AC4F97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2716	regsvr32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2716	regsvr32.exe
2716	regsvr32.exe
2716	regsvr32.exe
2716	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3440	jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2716	3440	jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe	89
PID 3440 wrote to memory of 5136	3440	jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Microsoft\ 739071902.dll
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_970a0e09337dc558aa4cddc99249fa7b55d7289a71cf84581c8047599c1f0c86.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

739071902.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\ 739071902.dll
Size 63KB
SHA256 1cd9ddaba634ba3a648d1aac7c46212b00a5db9030d80c3c8cc4daae2857f330
MD5 27f03fd48be59e40c19f51543bd9e463
SHA1 8fb193cc48f7486629dcba4716e6aaa6faa1ca25
SHA512 ecd33d890d6588880c14280117465b1d372089f75c024b54a80dca1164bbf768b07c839af04e6405fe4b76fd8750601384163a4dc5cabc7eabd12199b66e895a
SSDEEP 768:QWrz/uwCBjMbgDRS913cwTZA/pVolvK1ZIQMhjOzjUZuUnml6c+GKGw/tivbpcv:hGw0MbghxSOzjVUml8FYvbp
TLSH
T1A05319227F5066B1E400497D26B5A3A2F2AEEE607821FFB2D3641D352C785B349C4F97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2716-6-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/3440-3-0x0000000000400000-0x0000000000419000-memory.dmp

Download