a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe
Size 74KB
Sample261002-ld2pgswvfy
SHA256 a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e
MD5 97e54b837a8fe61c8ec998043f975b52
SHA1 8b6a1886ee061397619a105cfed92684a19aa9f1
SHA512 8de98ea5cfaa1e5e61550f5572186d0fdc966bab2f9c4a31c2ced42bc4804b29d935027e59d9c07e6d0d855d66f42724448e83b67f72e15bec72e5ccc639524f
SSDEEP 1536:iaG1vWufIBOn+cqSTZmSC/bzpqvSSnpYu4U97e+yE1oP:81dfI0nFqgZI/bE6QpYK97evE1Y
TLSH
T1F773F109D1C5DDA1E83A11FD304AA75FC22964B1126F279CB9E44E6436C38DF3C15FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2524	flash.exe
4600	clear.exe
2504	sm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows OS Function = "C:\\Windows\\system32\\win32osf.exe"	flash.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\win32osf.tmp	flash.exe
File created	C:\Windows\SysWOW64\win32osf.exe	flash.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c574-24.dat	upx
behavioral2/memory/2504-29-0x0000000000100000-0x000000000021A000-memory.dmp	upx
behavioral2/memory/2504-34-0x0000000000100000-0x000000000021A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2560	1216	WerFault.exe	87
2796	4600	WerFault.exe	96
5884	2504	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clear.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	flash.exe

Runs net.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3208	1216	jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe	89
PID 3208 wrote to memory of 3864	3208	net.exe	92
PID 1216 wrote to memory of 2524	1216	jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe	95
PID 1216 wrote to memory of 4600	1216	jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe	96
PID 1216 wrote to memory of 2504	1216	jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a27599d623f7b721a982b9fc36917c4e8103baef36d4010b39b66134b490f45e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\windows\SysWOW64\net.exe
  "C:\windows\system32\net.exe" stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 1164
  2⤵
  - Program crash
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\flash.exe
  "C:\Users\Admin\AppData\Local\Temp\flash.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\clear.exe
  "C:\Users\Admin\AppData\Local\Temp\clear.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 264
    3⤵
    - Program crash
    PID:2796
- C:\Users\Admin\AppData\Local\Temp\sm.exe
  "C:\Users\Admin\AppData\Local\Temp\sm.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 308
    3⤵
    - Program crash
    PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1216 -ip 1216
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4600 -ip 4600
1⤵
PID:2436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2504 -ip 2504
1⤵
PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clear.exe

Path C:\Users\Admin\AppData\Local\Temp\clear.exe
Size 28KB
SHA256 5d174913b0d8da1d3de3dad3917d1197b76723d773ba6f779d9ac35f4d479abb
MD5 0c1538e997e23d8ce9f994aeb82f83d2
SHA1 e6bafbda265e52eb267d87f8a2a29539f0eb8032
SHA512 0456720a09a0ee6122bfc87c27d8610ab2c2a637ff6ea43549d0c5e97f5f5db3247e5e1ee994833f6cd28711c1b2fca6c735c030c085466fe7a7b573eea07867
SSDEEP 768:Ug3cvrLFVjMCTWdye8Z7mj7gAwo/hdeVfu:8XqS7oUu
TLSH
T11DD2D0361613FCEED98DA13708D1F52776186BE0A743AE3696B108C23BDF501F663A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flash.exe

Path C:\Users\Admin\AppData\Local\Temp\flash.exe
Size 3KB
SHA256 6c9b3da8ac530f4708fa44c3750a08d16e0ded0f82ec8310d9b4a3d35b09ea5f
MD5 9016cf61952b04ec5e241698105d3132
SHA1 ba06ba753dc5c6a76ec7275103176d400281c04f
SHA512 016ff51b511905637a0ac27ab645a126e044dd4658ac0c4b9811e2fa8e02216d48446d25f918dde52fc5781d60b86bac535d4044bfeb7cd3b179de51676361c1
TLSH
T1AA71B42297118C9BC0E50134755CF79A945A2C7503179C16B7C8929B0AF323BBAF8F22
MD5 SHA1 SHA512 TLSH

Submit Download

sm.exe

Path C:\Users\Admin\AppData\Local\Temp\sm.exe
Size 38KB
SHA256 ce5437b47c5e6bb6138a0f98ed0bdb7d55e134c9dc44dd4d2f4026f48a275f94
MD5 971a2a82045b7a7ad51266e49443e12c
SHA1 83925b32a54854a2e0afd21ab71e6f2a8e6c3ab7
SHA512 446ca07f4678be7be842c020abd5ea359a13a3ccd323409375d534f7051f8496dcdde0e6c644951bbdfabe514142b7aeff0143ae94362aa58c326ec10fd51dc0
SSDEEP 768:EIR0sA7t92HNnKrgLGUaWSdNpwhMbpn8WSebIx0/bixV4bdi6YlUndg:E5IHNneBNOhMdn+x0/mNU
TLSH
T15C03E1728B07F533DA23E736239F4978A68F9157DFA946903E2F5488C2B56008E17736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1216-31-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2504-29-0x0000000000100000-0x000000000021A000-memory.dmp

Download

memory/2504-32-0x0000000000219000-0x000000000021A000-memory.dmp

Download

memory/2504-34-0x0000000000100000-0x000000000021A000-memory.dmp

Download

memory/2524-9-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/2524-35-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/4600-20-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads