80bab789f375b5ca82882e7dcc896a8ce9565f40680e1aefceb9f1f43a90dc38

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.exe
Size 322KB
Sample261014-endbbafz3k
SHA256 80bab789f375b5ca82882e7dcc896a8ce9565f40680e1aefceb9f1f43a90dc38
MD5 cd78c31240fa1ca42da601df99752489
SHA1 c5b470a76879cf85d4c7b09940d4621cc75ab8b3
SHA512 02e699e05fac9e6b61652c7d19ae0e23ad518b91483282b63418ba18fa1f0e1f80e7481c61f64997c1a2531f533748f40521fcd97bd15ce81c6bf1d0f21f4f0b
SSDEEP 6144:5+WYNyZ7JeBVT3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wf:5LlZFeBVT3D0Fw/tN8dkmLtpHHHrh72g
TLSH
T19C64128567E894A2FBEB88B144B3BB279675B4646C00E71F93089C5A3C71741FD2CB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4252	Au_.exe

Loads dropped DLL 2 IoCs

pid	Process
4252	Au_.exe
4252	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4252	2072	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\System.dll
Size 11KB
SHA256 19227e1d2a655edb5fd419e5b9d99769ca3e8d5a3e08a549c3d21ff935b90de6
MD5 ec539506ff2972b2743d8509420003b2
SHA1 3eb85366aef39567c8bb2c1d855137a6e1a3af90
SHA512 1b79de5ae081c0ce54a26fa68db17ba19f9857cea022db0461b88983876d08d2810967336f17a06da73764f9883190eb78bf66657e0a85431fc11cad60be0de1
SSDEEP 192:UcVawmS09nufUEEUmH+Opt+MadSfhzWokC9EbjKtKa1h:UXhpH+mhaS9WoryCYih
TLSH
T1DE322B01BBA251F5F691413508BB3B374FA8A42106E58E47CF939459AC2B2A13D3A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\modern-wizard.bmp
Size 150KB
SHA256 732ed3339052cef54c2a92e3fb5e2e30f8666915917b13142b5f525a6190aaca
MD5 bc60dae3f5120d9437d07b08bc5de720
SHA1 d3b2a437664bd9934de2b29660ee37b98ead7c6e
SHA512 67ebc37f038d04741f7c4545a12a9fa0db4ccae5299d69d3367408ddc233dcb5a754e703c27d63f60373ee5ca95ef1681e1be22b50a2988c2243cc3244c7a9df
SSDEEP 48:QC7k8Sq14m0xhCxk8r5sTF7qf4UspLk8CW0IzrFDHNg:Q/8Sm0zCxk8Fsh7qf4UsW8BnxNg
TLSH
T1A7E331259EBD906A6B7CB10ABD0B2ECE34815F8F5F0268C75647768654768CF9334383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nspE8E.tmp\nsDialogs.dll
Size 9KB
SHA256 93de321cfdbc1e71a9f7f1bc4ee1de4dd7d05696f9c96a21415c5e0e1b8f951c
MD5 fa0c5a13e10f1b45c8719b1b428e39d1
SHA1 cfb4542c2d9f335cd4959c07b3f9f8f875663fbf
SHA512 4b2314e1c6368eea13506d167e2c085c96337875dcda386a81c1badd8990519c61106e7cb6f827613dd45d69cca6f82cf1beba88685dc8be0abf3c7e8c6c010c
SSDEEP 192:CezEx5Dv3+Im95quFUbroIvV/3qd88dkvTX:CeggqzV/3qd88o
TLSH
T178120763B99594F2CBA70131366A3F63E364935475293C06D7B38E8D6C1A2C63E3C306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Au_.exe

Path C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
Size 322KB
SHA256 80bab789f375b5ca82882e7dcc896a8ce9565f40680e1aefceb9f1f43a90dc38
MD5 cd78c31240fa1ca42da601df99752489
SHA1 c5b470a76879cf85d4c7b09940d4621cc75ab8b3
SHA512 02e699e05fac9e6b61652c7d19ae0e23ad518b91483282b63418ba18fa1f0e1f80e7481c61f64997c1a2531f533748f40521fcd97bd15ce81c6bf1d0f21f4f0b
SSDEEP 6144:5+WYNyZ7JeBVT3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wf:5LlZFeBVT3D0Fw/tN8dkmLtpHHHrh72g
TLSH
T19C64128567E894A2FBEB88B144B3BB279675B4646C00E71F93089C5A3C71741FD2CB93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads