87464fde1a3a7c2b5f61a2c40f9265415c15cc87655a2c133c9e0ba41fd8011c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 1.0MB
Sample261013-13xt6acy8m
SHA256 87464fde1a3a7c2b5f61a2c40f9265415c15cc87655a2c133c9e0ba41fd8011c
MD5 ccef116b44a0b13837056135d78d7c59
SHA1 6bb18f23dc887d0c6127a5e133c4b5e15d245f32
SHA512 7570ac395ee5bbcd69adfc4061c83daf4399c87061ec9e55ce83a1464a83dbb1bd37996a2d4778c9912aac5a961a43644f0006824ce8a781a75fd3ae4785486b
SSDEEP 12288:OmDslhGuVgpPjiBSRsNyzBP5bjpIzdzZjd+hnHCuNXM1u9sBvA5+f+hisooqqMQQ:OmlPUg7FoROnHCulWu9uv3WQs3qqM1U4
TLSH
T1E525B2A498696B3BF77BDA178DBE7929CB1133F7BB13A5DF1424648100633929F0250E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\microsoft\edge\application\msedge.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	\??\c:\program files (x86)\adobe\acrotray .exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2760	4868	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
4868	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 672
  2⤵
  - Program crash
  PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4868 -ip 4868
1⤵
PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmpscfgs.exe

Path C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
Size 1.0MB
SHA256 4b152bf96f75873f2a81b712643cbee5712b7ce02cb63b1d1f56e711bd34b3c5
MD5 cafaa7b4376116352d0b285eb02a6518
SHA1 466b86cfddecbaf0d776e1ccaa331d81ab366077
SHA512 ed629554988b7e30931df34ca8bb9e39ac4d4d82156cb1c4781ecdfb18cdc931646c2b06a0e4734609c15dca32744ded44eda605a6809d541b8b7e6687aff784
SSDEEP 24576:OmlPUg7FoROnHCulWu9uv3WQs3qqM1UEGf:hpoHZ3y3rf
TLSH
T12A35B2A498696B3BF77BDA178DBE7929CB1133F7BB13A5DF5424648100633829F0250E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4868-0-0x0000000010000000-0x0000000010010000-memory.dmp

Download