dd7431dbb1211b482d230ecf1d26a636f8cba6e2abb304e6816ad23f673491ff

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Packed.Win32.Klone.bq.exe
Size 178KB
Sample261014-kagpgafc56
SHA256 dd7431dbb1211b482d230ecf1d26a636f8cba6e2abb304e6816ad23f673491ff
MD5 c3d84435f15a952c4ed09d6d1c2aef9b
SHA1 1f80b8e2592a5f5872b325d46f8e51bac0615724
SHA512 f5bf81c50002a278ae88387723b7606aef6c0f7e25fda90bd65c21f70d3e64fe9974417214d67adcfe03212c75463979cf4a610b82d58a4ac95b0c2f47196a64
SSDEEP 3072:YomYd626O+nliUriN+UR0QYx20aDu1X0OYBEDos9P2SKmVb:RmOh6O+nxrii408NWDos9+S9b
TLSH
T103040262A5DCAF3EEA5523724DF23231D1E868727D39157AB5C89C492983636CF04FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4028	5368	WerFault.exe	86
6008	5368	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Packed.Win32.Klone.bq.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Klone.bq.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Packed.Win32.Klone.bq.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 264
  2⤵
  - Program crash
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 284
  2⤵
  - Program crash
  PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5368 -ip 5368
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5368 -ip 5368
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5368-0-0x0000000000400000-0x0000000000496000-memory.dmp

Download

memory/5368-1-0x0000000000400000-0x0000000000496000-memory.dmp