Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 19:01
General
- Target jaffacakes118_Packed.Win32.Krap.jc.exe
- Size 834KB
- Sample261012-xppd3sws8q
- SHA256 35e03dac32d800032be59fe30f60bad4db3e25d103490f6d96ab213abce9a896
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Krap.jc.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Krap.jc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\skorfo.exe"C:\ProgramData\skorfo.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\skorfo.exeC:\ProgramData\skorfo.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DDF.sys .exe
Mira.h
skorfo.exe
DumpStack.log.tmp .exe
PerfLogs .exe
Program Files (x86) .exe
Program Files .exe
ProgramData .exe
System Volume Information .exe
Users .exe
Users .exe
pagefile.sys .exe
swapfile.sys .exe
$RECYCLE.BIN .exe
System Volume Information .exe
memory/4228-0-0x0000000000400000-0x000000000044F000-memory.dmp
memory/4228-9-0x0000000000400000-0x000000000044F000-memory.dmp
memory/4304-56-0x0000000000400000-0x0000000000448000-memory.dmp
memory/5716-55-0x0000000000400000-0x0000000000448000-memory.dmp