Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
- Size 469KB
- Sample261014-fdextsfx7t
- SHA256 d1fa2bb877396cc7e071e35c5c8bc2cf9133bcdc8e94498544828f6c841f758d
- MD5 2b34edefe8ff739993ac48b226fc8ad0
- SHA1 867147e2678176e8b86df7f17aab22b5749512b3
- SHA512 6628ec0feba7d84a7ccb55331a99b57681fa7abd17e1e24c615519fc20437709f35d298933430e4306545c0991a7745088eb986333300507679c3ff9d25344c2
- SSDEEP 12288:GHYRuAGQo3R8ewHUYEzieBY8vQUAbqdeDGPj+:PRGQo3aew5ExBMa9S
- TLSH T107A48D167AF9D031E17242358FAEF70184BDF972092A554B73D84B1E2AB04C3EA25F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 2340 4204 WerFault.exe 85 - Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 540 wmic.exe Token: SeSecurityPrivilege 540 wmic.exe Token: SeTakeOwnershipPrivilege 540 wmic.exe Token: SeLoadDriverPrivilege 540 wmic.exe Token: SeSystemProfilePrivilege 540 wmic.exe Token: SeSystemtimePrivilege 540 wmic.exe Token: SeProfSingleProcessPrivilege 540 wmic.exe Token: SeIncBasePriorityPrivilege 540 wmic.exe Token: SeCreatePagefilePrivilege 540 wmic.exe Token: SeBackupPrivilege 540 wmic.exe Token: SeRestorePrivilege 540 wmic.exe Token: SeShutdownPrivilege 540 wmic.exe Token: SeDebugPrivilege 540 wmic.exe Token: SeSystemEnvironmentPrivilege 540 wmic.exe Token: SeRemoteShutdownPrivilege 540 wmic.exe Token: SeUndockPrivilege 540 wmic.exe Token: SeManageVolumePrivilege 540 wmic.exe Token: 33 540 wmic.exe Token: 34 540 wmic.exe Token: 35 540 wmic.exe Token: 36 540 wmic.exe Token: SeIncreaseQuotaPrivilege 540 wmic.exe Token: SeSecurityPrivilege 540 wmic.exe Token: SeTakeOwnershipPrivilege 540 wmic.exe Token: SeLoadDriverPrivilege 540 wmic.exe Token: SeSystemProfilePrivilege 540 wmic.exe Token: SeSystemtimePrivilege 540 wmic.exe Token: SeProfSingleProcessPrivilege 540 wmic.exe Token: SeIncBasePriorityPrivilege 540 wmic.exe Token: SeCreatePagefilePrivilege 540 wmic.exe Token: SeBackupPrivilege 540 wmic.exe Token: SeRestorePrivilege 540 wmic.exe Token: SeShutdownPrivilege 540 wmic.exe Token: SeDebugPrivilege 540 wmic.exe Token: SeSystemEnvironmentPrivilege 540 wmic.exe Token: SeRemoteShutdownPrivilege 540 wmic.exe Token: SeUndockPrivilege 540 wmic.exe Token: SeManageVolumePrivilege 540 wmic.exe Token: 33 540 wmic.exe Token: 34 540 wmic.exe Token: 35 540 wmic.exe Token: 36 540 wmic.exe Token: SeIncreaseQuotaPrivilege 4456 wmic.exe Token: SeSecurityPrivilege 4456 wmic.exe Token: SeTakeOwnershipPrivilege 4456 wmic.exe Token: SeLoadDriverPrivilege 4456 wmic.exe Token: SeSystemProfilePrivilege 4456 wmic.exe Token: SeSystemtimePrivilege 4456 wmic.exe Token: SeProfSingleProcessPrivilege 4456 wmic.exe Token: SeIncBasePriorityPrivilege 4456 wmic.exe Token: SeCreatePagefilePrivilege 4456 wmic.exe Token: SeBackupPrivilege 4456 wmic.exe Token: SeRestorePrivilege 4456 wmic.exe Token: SeShutdownPrivilege 4456 wmic.exe Token: SeDebugPrivilege 4456 wmic.exe Token: SeSystemEnvironmentPrivilege 4456 wmic.exe Token: SeRemoteShutdownPrivilege 4456 wmic.exe Token: SeUndockPrivilege 4456 wmic.exe Token: SeManageVolumePrivilege 4456 wmic.exe Token: 33 4456 wmic.exe Token: 34 4456 wmic.exe Token: 35 4456 wmic.exe Token: 36 4456 wmic.exe Token: SeIncreaseQuotaPrivilege 4456 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4204 wrote to memory of 540 4204 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 86 PID 4204 wrote to memory of 4456 4204 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 90 PID 4204 wrote to memory of 1984 4204 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 93 PID 4204 wrote to memory of 3256 4204 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 95 PID 4204 wrote to memory of 5088 4204 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953109.txt bios get serialnumber2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953109.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953109.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1984
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953109.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3256
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953109.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5088
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 6922⤵
- Program crash
PID:2340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 42041⤵PID:1020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81791953109.txt
- Size 58B
- SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
- MD5 f8e2f71e123c5a848f2a83d2a7aef11e
- SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
- SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
- TLSH T177A00212415CC100546359409055523816936890483D1829024C004693D74015451BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81791953109.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\81791953109.txt
- Size 70B
- SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
- MD5 5b21bdfd2dcb4143105a1642e631bf89
- SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
- SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
- TLSH T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
- MD5 SHA1 SHA512 TLSH