c91e1cae3a116a19eedce1951add2530b5ce923c4e52ad916157d5d6add03a48

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Size 348KB
Sample261018-s8vb8afz7v
SHA256 c91e1cae3a116a19eedce1951add2530b5ce923c4e52ad916157d5d6add03a48
MD5 b603df7ddafab73943fe195648db4048
SHA1 bdc3400b115d18587b623ebce5d2af4c7b8ee335
SHA512 6fafc9081b693f6f2b6f798b33f66b35d11932c4925a9b9f4986f6806169a25a4f1df73607ef337c1b26cdc6277ddbe66e3619b5d9a1e1fdccd0cd39b8fdac82
SSDEEP 6144:H1y79MRx0/rR8CH8ioIfKHCH8iU79MRx0/rR:Vy6Re6CeCg6Re
TLSH
T1B1749D237F189513EAAA41B258F6C1F93B707D240A905D073186FF6F2C716A365AB31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5872	5832	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5832	jaffacakes118_UDS.DangerousObject.Multi.Generic.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_UDS.DangerousObject.Multi.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 1432
  2⤵
  - Program crash
  PID:5872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5832 -ip 5832
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads