80ff9a2c26d04da05144516603f05fdc529a8a6abd8b2c4e8ca317a80803297b

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Virus.Win32.Virut.ce.exe
Size 1.2MB
Sample261012-1bdbfafv2v
SHA256 80ff9a2c26d04da05144516603f05fdc529a8a6abd8b2c4e8ca317a80803297b
MD5 43ee7d9a44a5a3e8dee1b66910c578a6
SHA1 a8b9d7b5d7dbea775150ec502be4ce09e1fec305
SHA512 eafbe9ec1deffc3d6cf8d8e5add3d84cbae103d18a1191e9e3412ad8c651d52cb189d8c27ae19867065dd84958adc96b895c8ffec97f0f22e818290c316ea36b
SSDEEP 24576:nW2UWXMQ74UvNk3CV7dWIVoJImqiPNd/PQVYFEZ0fYbwZHp0Mo0KEds:nB8Q7JkSVtyegPCuEjJ
TLSH
T18B4523493056157FC8D02AF5B8D1CEFA7A22313187938E507BD9A97AF86370433B674A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Virut.ce.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Virus.Win32.Virut.ce.exe:*:enabled:@shell32.dll,-1"	jaffacakes118_Virus.Win32.Virut.ce.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	jaffacakes118_Virus.Win32.Virut.ce.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	jaffacakes118_Virus.Win32.Virut.ce.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	jaffacakes118_Virus.Win32.Virut.ce.exe

Program crash 10 IoCs

pid	pid_target	Process	procid_target
2028	1092	WerFault.exe	88
2404	1092	WerFault.exe	88
5872	1092	WerFault.exe	88
5212	1092	WerFault.exe	88
1660	1092	WerFault.exe	88
2904	1092	WerFault.exe	88
716	1092	WerFault.exe	88
472	1092	WerFault.exe	88
4120	1092	WerFault.exe	88
5444	1092	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Virus.Win32.Virut.ce.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Virus.Win32.Virut.ce.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Virus.Win32.Virut.ce.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe

Suspicious behavior: MapViewOfSection 1 TTPs 64 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe
1092	jaffacakes118_Virus.Win32.Virut.ce.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	jaffacakes118_Virus.Win32.Virut.ce.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Virut.ce.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Virut.ce.exe"
1⤵
- Modifies firewall policy service
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 932
  2⤵
  - Program crash
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 888
  2⤵
  - Program crash
  PID:2404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 944
  2⤵
  - Program crash
  PID:5872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 944
  2⤵
  - Program crash
  PID:5212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 892
  2⤵
  - Program crash
  PID:1660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1108
  2⤵
  - Program crash
  PID:2904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1132
  2⤵
  - Program crash
  PID:716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1268
  2⤵
  - Program crash
  PID:472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1404
  2⤵
  - Program crash
  PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1400
  2⤵
  - Program crash
  PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1092 -ip 1092
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1092 -ip 1092
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1092 -ip 1092
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1092 -ip 1092
1⤵
PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1092 -ip 1092
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1092 -ip 1092
1⤵
PID:5488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1092 -ip 1092
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1092 -ip 1092
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1092 -ip 1092
1⤵
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1092 -ip 1092
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Process Injection

T1055

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-0-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/1092-3-0x0000000077229000-0x000000007722A000-memory.dmp

Download

memory/1092-2-0x0000000077228000-0x0000000077229000-memory.dmp

Download

memory/1092-1-0x000000007FE90000-0x000000007FE9C000-memory.dmp

Download

memory/1092-4-0x0000000002570000-0x0000000002572000-memory.dmp

Download

memory/1092-5-0x000000007FE90000-0x000000007FE9C000-memory.dmp

Download

memory/1092-6-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/1092-7-0x000000007FE90000-0x000000007FE9C000-memory.dmp

Download

memory/1092-8-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/1092-9-0x000000007FE90000-0x000000007FE9C000-memory.dmp

Download