4a5b351b29853543dd53bd4ee710b63ffbf37677f650d004333bfa12921c7c34

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Size 288KB
Sample261014-fdc38sws8n
SHA256 4a5b351b29853543dd53bd4ee710b63ffbf37677f650d004333bfa12921c7c34
MD5 f37a6efaa28c890121bedbba60a6802a
SHA1 eca1335c8514437c3c5c22f7bb86bc7848d04888
SHA512 8cd4edd7c3a7c6463f9c444b77e1022e84ea68c29ec2701a337e3ef2eb297f6c7f7e8d02c2993a685dbca64dfa444103275b3f96a4edecc8588b10eae2114c8e
SSDEEP 6144:FFJ0P7Fzx6zl/zSOyMmouBWL6qzw/hmvDwrW+MVwG:wRYx9vmoZL6qzw/hADW7y3
TLSH
T174541242ABD04E6BFFE1C9709276B5A2C777859523EB0043A3300DBE3867696D7847D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5676	beffabfhed.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
204	5676	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	beffabfhed.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	beffabfhed.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beffabfhed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3108	wmic.exe
3108	wmic.exe
3108	wmic.exe
3108	wmic.exe
5736	wmic.exe
5736	wmic.exe
5736	wmic.exe
5736	wmic.exe
2972	wmic.exe
2972	wmic.exe
2972	wmic.exe
2972	wmic.exe
1684	wmic.exe
1684	wmic.exe
1684	wmic.exe
1684	wmic.exe
4252	wmic.exe
4252	wmic.exe
4252	wmic.exe
4252	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3108	wmic.exe
Token: SeSecurityPrivilege	3108	wmic.exe
Token: SeTakeOwnershipPrivilege	3108	wmic.exe
Token: SeLoadDriverPrivilege	3108	wmic.exe
Token: SeSystemProfilePrivilege	3108	wmic.exe
Token: SeSystemtimePrivilege	3108	wmic.exe
Token: SeProfSingleProcessPrivilege	3108	wmic.exe
Token: SeIncBasePriorityPrivilege	3108	wmic.exe
Token: SeCreatePagefilePrivilege	3108	wmic.exe
Token: SeBackupPrivilege	3108	wmic.exe
Token: SeRestorePrivilege	3108	wmic.exe
Token: SeShutdownPrivilege	3108	wmic.exe
Token: SeDebugPrivilege	3108	wmic.exe
Token: SeSystemEnvironmentPrivilege	3108	wmic.exe
Token: SeRemoteShutdownPrivilege	3108	wmic.exe
Token: SeUndockPrivilege	3108	wmic.exe
Token: SeManageVolumePrivilege	3108	wmic.exe
Token: 33	3108	wmic.exe
Token: 34	3108	wmic.exe
Token: 35	3108	wmic.exe
Token: 36	3108	wmic.exe
Token: SeIncreaseQuotaPrivilege	3108	wmic.exe
Token: SeSecurityPrivilege	3108	wmic.exe
Token: SeTakeOwnershipPrivilege	3108	wmic.exe
Token: SeLoadDriverPrivilege	3108	wmic.exe
Token: SeSystemProfilePrivilege	3108	wmic.exe
Token: SeSystemtimePrivilege	3108	wmic.exe
Token: SeProfSingleProcessPrivilege	3108	wmic.exe
Token: SeIncBasePriorityPrivilege	3108	wmic.exe
Token: SeCreatePagefilePrivilege	3108	wmic.exe
Token: SeBackupPrivilege	3108	wmic.exe
Token: SeRestorePrivilege	3108	wmic.exe
Token: SeShutdownPrivilege	3108	wmic.exe
Token: SeDebugPrivilege	3108	wmic.exe
Token: SeSystemEnvironmentPrivilege	3108	wmic.exe
Token: SeRemoteShutdownPrivilege	3108	wmic.exe
Token: SeUndockPrivilege	3108	wmic.exe
Token: SeManageVolumePrivilege	3108	wmic.exe
Token: 33	3108	wmic.exe
Token: 34	3108	wmic.exe
Token: 35	3108	wmic.exe
Token: 36	3108	wmic.exe
Token: SeIncreaseQuotaPrivilege	5736	wmic.exe
Token: SeSecurityPrivilege	5736	wmic.exe
Token: SeTakeOwnershipPrivilege	5736	wmic.exe
Token: SeLoadDriverPrivilege	5736	wmic.exe
Token: SeSystemProfilePrivilege	5736	wmic.exe
Token: SeSystemtimePrivilege	5736	wmic.exe
Token: SeProfSingleProcessPrivilege	5736	wmic.exe
Token: SeIncBasePriorityPrivilege	5736	wmic.exe
Token: SeCreatePagefilePrivilege	5736	wmic.exe
Token: SeBackupPrivilege	5736	wmic.exe
Token: SeRestorePrivilege	5736	wmic.exe
Token: SeShutdownPrivilege	5736	wmic.exe
Token: SeDebugPrivilege	5736	wmic.exe
Token: SeSystemEnvironmentPrivilege	5736	wmic.exe
Token: SeRemoteShutdownPrivilege	5736	wmic.exe
Token: SeUndockPrivilege	5736	wmic.exe
Token: SeManageVolumePrivilege	5736	wmic.exe
Token: 33	5736	wmic.exe
Token: 34	5736	wmic.exe
Token: 35	5736	wmic.exe
Token: 36	5736	wmic.exe
Token: SeIncreaseQuotaPrivilege	5736	wmic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 5676	3280	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe	89
PID 5676 wrote to memory of 3108	5676	beffabfhed.exe	90
PID 5676 wrote to memory of 5736	5676	beffabfhed.exe	93
PID 5676 wrote to memory of 2972	5676	beffabfhed.exe	95
PID 5676 wrote to memory of 1684	5676	beffabfhed.exe	97
PID 5676 wrote to memory of 4252	5676	beffabfhed.exe	99

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\beffabfhed.exe
  C:\Users\Admin\AppData\Local\Temp\beffabfhed.exe 5)1)7)1)4)3)1)5)6)3)0 Kk9CQzkvMzIrNSAqUk5BTEZDOCodL0lETVZLT0pEPjowGy49SE9RSD83MDAvODAfK0BIPzctICpPS05AUkJPWUZEODEyNi42HypNQlJRREteUU9LOGJxdGs5KC5vb3UpPkJTRixNTkwqQEtKK0lJRUgfK0BLRD1IST88GS5ALjwwKzU5LTEtHytBMTgsLzcuHyhDLzosLBosRC88JjAcLEMwNyoxGy5JUUtBVD5OXFBNSE9AP1Y8GylNUkpDTkJQXERQRj49Gy5JUUtBVD5OXE48TD48P2xiZmlwLk1kWm9hby1xLyswKTMmYy8wbzAxXjdwHyhEVEJeUExJPWNzbW82LC5fKzNvXjAuZW5nczIwby5ea2h0YGNxamhxLmlkbS5vYnNwalxycC1ed2EdLkBSQl8+TD1LRUtEOBosSEpSTV4+T05STUJSOC8ZLlBFQElFVk9QXk5RSDofKlBKPS0fKENPLjwbKU9VSVNCTEFcVkBGQE9IREJMPUREUExJPRsuQlJbT1RJTkZNQDxtcXFiHypMQlRQUUdISkReUE1CUlpDOlhPOjEbKUVJP0RRPC0dLkRNXERUTTpMRUBeQEhAUlRPTURAOmVcZnBlGy49TlNLS0o7QV9ETzYwMTUtMTMrMis1JzUvHS5LO09BR0s+S1tGTU5OPkxHPG1xcWIfKk5GTUA8KjMxMzUvLDU3Lx8oQ0tUTUdJPkRaU0JMQToxKiw1Ly0vKjUmNDkrKzcxLyk6TA==
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81791953104.txt bios get serialnumber
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81791953104.txt bios get version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81791953104.txt bios get version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2972
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81791953104.txt bios get version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /output:C:\Users\Admin\AppData\Local\Temp\81791953104.txt bios get version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 936
    3⤵
    - Program crash
    PID:204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5676 -ip 5676
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81791953104.txt

Path C:\Users\Admin\AppData\Local\Temp\81791953104.txt
Size 70B
SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
MD5 5b21bdfd2dcb4143105a1642e631bf89
SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
TLSH
T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
MD5 SHA1 SHA512 TLSH

Submit Download

81791953104.txt

Path C:\Users\Admin\AppData\Local\Temp\81791953104.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

81791953104.txt

Path C:\Users\Admin\AppData\Local\Temp\81791953104.txt
Size 58B
SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
MD5 f8e2f71e123c5a848f2a83d2a7aef11e
SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
TLSH
T177A00212415CC100546359409055523816936890483D1829024C004693D74015451BEB
MD5 SHA1 SHA512 TLSH

Submit Download

beffabfhed.exe

Path C:\Users\Admin\AppData\Local\Temp\beffabfhed.exe
Size 569KB
SHA256 29ae9d682ff68d8498a0df37dd1f5dc4dc23879dda47f29f491d4a53890b3321
MD5 b193af3d0371b5f27523ab5a836ada96
SHA1 073907e2dd63de28c4cadc9db94450a5648eea73
SHA512 fa95dbde32691ad06e72fa2020382dea651a23a5caec66fabac3e847e9bafb0e8b9b5bbce708cfb89cf24403f64190328d9b2dee398e3bab0aeb0366513ff159
SSDEEP 12288:rLqKzrU3VEPS26dgPxsUeaYPFPmyqDseCwr5FS/TsR+:r+FIsvaYPFPmvlCwG
TLSH
T181C44B187AB5C13AE1B682F19AACDB15507E6831175A15C3F3C94F2D1970CD2AF32A3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download