Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 18:54
General
- Target jaffacakes118_Packed.Win32.Krap.b.exe
- Size 242KB
- Sample261012-xkmppaed52
- SHA256 b772ec5c87640a85ffe28518c63a83b33e5983b313436a8dcc4ec15505a1f7d8
Malware Config
Signatures
- Executes dropped EXE 10 IoCs
- Drops file in System32 directory 22 IoCs
- Program crash 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Krap.b.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Krap.b.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 3562⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1160 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Krap.b.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 3643⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1164 "C:\Windows\SysWOW64\live.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 3324⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1120 "C:\Windows\SysWOW64\live.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 3285⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1132 "C:\Windows\SysWOW64\live.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3412 -s 3286⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1136 "C:\Windows\SysWOW64\live.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 3287⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1140 "C:\Windows\SysWOW64\live.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 3288⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1144 "C:\Windows\SysWOW64\live.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 3329⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1148 "C:\Windows\SysWOW64\live.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 32810⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1152 "C:\Windows\SysWOW64\live.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 32811⤵
- Program crash
-
-
C:\Windows\SysWOW64\live.exeC:\Windows\system32\live.exe 1156 "C:\Windows\SysWOW64\live.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 33212⤵
- Program crash
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1028 -ip 10281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2992 -ip 29921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3088 -ip 30881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1180 -ip 11801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3412 -ip 34121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3264 -ip 32641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 624 -ip 6241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2724 -ip 27241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 756 -ip 7561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4404 -ip 44041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3564 -ip 35641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
live.exe
memory/624-66-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/624-67-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/624-68-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/624-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/624-76-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/624-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/756-91-0x0000000000400000-0x0000000000411000-memory.dmp
memory/756-80-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/756-90-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/756-85-0x0000000000400000-0x0000000000411000-memory.dmp
memory/756-82-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/756-81-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1028-4-0x00000000020E0000-0x0000000002166000-memory.dmp
memory/1028-2-0x00000000005A0000-0x0000000000605000-memory.dmp
memory/1028-18-0x00000000005A0000-0x0000000000605000-memory.dmp
memory/1028-6-0x0000000000610000-0x0000000000611000-memory.dmp
memory/1028-5-0x00000000005A0000-0x0000000000605000-memory.dmp
memory/1028-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1028-3-0x00000000005A0000-0x0000000000605000-memory.dmp
memory/1028-19-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1028-1-0x00000000005A0000-0x0000000000605000-memory.dmp
memory/1180-42-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1180-55-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1180-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1180-49-0x0000000002100000-0x0000000002186000-memory.dmp
memory/1180-48-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1180-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1180-46-0x0000000000570000-0x0000000000571000-memory.dmp
memory/1180-43-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1180-39-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/1180-40-0x0000000002100000-0x0000000002186000-memory.dmp
memory/1180-41-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/2724-74-0x00000000020A0000-0x0000000002105000-memory.dmp
memory/2724-83-0x00000000020A0000-0x0000000002105000-memory.dmp
memory/2724-75-0x00000000020A0000-0x0000000002105000-memory.dmp
memory/2724-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2724-73-0x00000000020A0000-0x0000000002105000-memory.dmp
memory/2724-84-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2992-17-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-32-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2992-15-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-16-0x00000000020C0000-0x0000000002146000-memory.dmp
memory/2992-20-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/2992-31-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-14-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2992-22-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-13-0x0000000002050000-0x00000000020B5000-memory.dmp
memory/2992-23-0x00000000020C0000-0x0000000002146000-memory.dmp
memory/3088-26-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-44-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-34-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3088-29-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-28-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-27-0x00000000020F0000-0x0000000002176000-memory.dmp
memory/3088-35-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-30-0x00000000004F0000-0x0000000000555000-memory.dmp
memory/3088-36-0x00000000020F0000-0x0000000002176000-memory.dmp
memory/3088-33-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/3088-45-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3264-60-0x0000000002040000-0x00000000020A5000-memory.dmp
memory/3264-59-0x0000000002040000-0x00000000020A5000-memory.dmp
memory/3264-61-0x0000000002040000-0x00000000020A5000-memory.dmp
memory/3264-69-0x0000000002040000-0x00000000020A5000-memory.dmp
memory/3264-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3264-64-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3412-62-0x0000000002090000-0x00000000020F5000-memory.dmp
memory/3412-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3412-53-0x0000000002090000-0x00000000020F5000-memory.dmp
memory/3412-54-0x0000000002090000-0x00000000020F5000-memory.dmp
memory/3412-52-0x0000000002090000-0x00000000020F5000-memory.dmp
memory/3412-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3564-94-0x00000000006C0000-0x0000000000725000-memory.dmp
memory/3564-95-0x00000000006C0000-0x0000000000725000-memory.dmp
memory/3564-96-0x00000000006C0000-0x0000000000725000-memory.dmp
memory/3564-99-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4404-89-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/4404-88-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/4404-92-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4404-87-0x0000000002060000-0x00000000020C5000-memory.dmp
memory/4404-98-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4404-97-0x0000000002060000-0x00000000020C5000-memory.dmp