Analysis
- max time kernel
150s - max time network
89s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe
- Size 469KB
- Sample261014-fdextsfx7t
- SHA256 d1fa2bb877396cc7e071e35c5c8bc2cf9133bcdc8e94498544828f6c841f758d
- MD5 2b34edefe8ff739993ac48b226fc8ad0
- SHA1 867147e2678176e8b86df7f17aab22b5749512b3
- SHA512 6628ec0feba7d84a7ccb55331a99b57681fa7abd17e1e24c615519fc20437709f35d298933430e4306545c0991a7745088eb986333300507679c3ff9d25344c2
- SSDEEP 12288:GHYRuAGQo3R8ewHUYEzieBY8vQUAbqdeDGPj+:PRGQo3aew5ExBMa9S
- TLSH T107A48D167AF9D031E17242358FAEF70184BDF972092A554B73D84B1E2AB04C3EA25F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 704 4108 WerFault.exe 88 - Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1116 wmic.exe 1116 wmic.exe 1116 wmic.exe 1116 wmic.exe 5864 wmic.exe 5864 wmic.exe 5864 wmic.exe 5864 wmic.exe 3504 wmic.exe 3504 wmic.exe 3504 wmic.exe 3504 wmic.exe 5072 wmic.exe 5072 wmic.exe 5072 wmic.exe 5072 wmic.exe 4144 wmic.exe 4144 wmic.exe 4144 wmic.exe 4144 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1116 wmic.exe Token: SeSecurityPrivilege 1116 wmic.exe Token: SeTakeOwnershipPrivilege 1116 wmic.exe Token: SeLoadDriverPrivilege 1116 wmic.exe Token: SeSystemProfilePrivilege 1116 wmic.exe Token: SeSystemtimePrivilege 1116 wmic.exe Token: SeProfSingleProcessPrivilege 1116 wmic.exe Token: SeIncBasePriorityPrivilege 1116 wmic.exe Token: SeCreatePagefilePrivilege 1116 wmic.exe Token: SeBackupPrivilege 1116 wmic.exe Token: SeRestorePrivilege 1116 wmic.exe Token: SeShutdownPrivilege 1116 wmic.exe Token: SeDebugPrivilege 1116 wmic.exe Token: SeSystemEnvironmentPrivilege 1116 wmic.exe Token: SeRemoteShutdownPrivilege 1116 wmic.exe Token: SeUndockPrivilege 1116 wmic.exe Token: SeManageVolumePrivilege 1116 wmic.exe Token: 33 1116 wmic.exe Token: 34 1116 wmic.exe Token: 35 1116 wmic.exe Token: 36 1116 wmic.exe Token: SeIncreaseQuotaPrivilege 1116 wmic.exe Token: SeSecurityPrivilege 1116 wmic.exe Token: SeTakeOwnershipPrivilege 1116 wmic.exe Token: SeLoadDriverPrivilege 1116 wmic.exe Token: SeSystemProfilePrivilege 1116 wmic.exe Token: SeSystemtimePrivilege 1116 wmic.exe Token: SeProfSingleProcessPrivilege 1116 wmic.exe Token: SeIncBasePriorityPrivilege 1116 wmic.exe Token: SeCreatePagefilePrivilege 1116 wmic.exe Token: SeBackupPrivilege 1116 wmic.exe Token: SeRestorePrivilege 1116 wmic.exe Token: SeShutdownPrivilege 1116 wmic.exe Token: SeDebugPrivilege 1116 wmic.exe Token: SeSystemEnvironmentPrivilege 1116 wmic.exe Token: SeRemoteShutdownPrivilege 1116 wmic.exe Token: SeUndockPrivilege 1116 wmic.exe Token: SeManageVolumePrivilege 1116 wmic.exe Token: 33 1116 wmic.exe Token: 34 1116 wmic.exe Token: 35 1116 wmic.exe Token: 36 1116 wmic.exe Token: SeIncreaseQuotaPrivilege 5864 wmic.exe Token: SeSecurityPrivilege 5864 wmic.exe Token: SeTakeOwnershipPrivilege 5864 wmic.exe Token: SeLoadDriverPrivilege 5864 wmic.exe Token: SeSystemProfilePrivilege 5864 wmic.exe Token: SeSystemtimePrivilege 5864 wmic.exe Token: SeProfSingleProcessPrivilege 5864 wmic.exe Token: SeIncBasePriorityPrivilege 5864 wmic.exe Token: SeCreatePagefilePrivilege 5864 wmic.exe Token: SeBackupPrivilege 5864 wmic.exe Token: SeRestorePrivilege 5864 wmic.exe Token: SeShutdownPrivilege 5864 wmic.exe Token: SeDebugPrivilege 5864 wmic.exe Token: SeSystemEnvironmentPrivilege 5864 wmic.exe Token: SeRemoteShutdownPrivilege 5864 wmic.exe Token: SeUndockPrivilege 5864 wmic.exe Token: SeManageVolumePrivilege 5864 wmic.exe Token: 33 5864 wmic.exe Token: 34 5864 wmic.exe Token: 35 5864 wmic.exe Token: 36 5864 wmic.exe Token: SeIncreaseQuotaPrivilege 5864 wmic.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4108 wrote to memory of 1116 4108 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 89 PID 4108 wrote to memory of 5864 4108 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 92 PID 4108 wrote to memory of 3504 4108 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 94 PID 4108 wrote to memory of 5072 4108 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 96 PID 4108 wrote to memory of 4144 4108 jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953111.txt bios get serialnumber2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953111.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953111.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3504
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953111.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic /output:C:\Users\Admin\AppData\Local\Temp\81791953111.txt bios get version2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 7682⤵
- Program crash
PID:704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4108 -ip 41081⤵PID:2072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\81791953111.txt
- Size 70B
- SHA256 5c3b49db1374e42e5047a3ab05b1ee7577cf78cf6e875889a164f54d1af6257b
- MD5 5b21bdfd2dcb4143105a1642e631bf89
- SHA1 0921933e59eacc03e31a28dd8be977bc2726ee21
- SHA512 41608db131f901209389d780a5ff1561f0c1dcc0cd2b2d8ed87f60bef852b80925d6f1ca8c9230558635ea4aff4f7c1c9ec099ca5d1b3a85514b26c57b517ae4
- TLSH T1DCA00243C7DC218EF1F64514FD30506C1BC330C11D7E014C0048002B86F784446103D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81791953111.txt
- Size 58B
- SHA256 79dae8edfddb5a748fb1ed83c87081b245aeff9178c95dcf5fbaaed6baf82121
- MD5 f8e2f71e123c5a848f2a83d2a7aef11e
- SHA1 5e7a9a2937fa4f06fdf3e33d7def7de431c159b4
- SHA512 8d34a80d335ee5be5d899b19b385aeaeb6bc5480fd72d3d9e96269da2f544ccc13b30fd23111980de736a612b8beb24ff062f6bed2eb2d252dbe07a2ffeb701e
- TLSH T177A00212415CC100546359409055523816936890483D1829024C004693D74015451BEB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\81791953111.txt
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512