efa4baf7a496c5a6264d232a7a5ea3987b5a93c6a98c291bee106ff4f99cccd2

Analysis

max time kernel
11s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Virus.Win32.Ipamor.c.exe
Size 96KB
Sample261018-tahq7sbf64
SHA256 efa4baf7a496c5a6264d232a7a5ea3987b5a93c6a98c291bee106ff4f99cccd2
MD5 a20668b69791cd126589b1f8b88280b1
SHA1 551e17dfae077ddef8624a16e949fc51dce8f874
SHA512 3221dae231a35280369270bea46040a0ac5c819e52ef8d73697ede49b04a449801a97e256910e18a6a1d0321cd8a8123449d4c292e4bce626cf7cc82225b27a2
SSDEEP 1536:2FbeITsAro5ZNjzFmAa6IBA2oESRAu0pcwuBiJRb:2FawsA+HjzFmRa2MAu+cJiJRb
TLSH
T142A38C4F978FC3E7C354443C0056EB35D294EB29E117EE0AE2E1C767A8714C798A92A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2628	MSWDM.EXE
2516	MSWDM.EXE
5948	JAFFACAKES118_VIRUS.WIN32.IPAMOR.C.EXE
2188	MSWDM.EXE
2424	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	jaffacakes118_Virus.Win32.Ipamor.c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	jaffacakes118_Virus.Win32.Ipamor.c.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dev4DB9.tmp	jaffacakes118_Virus.Win32.Ipamor.c.exe
File opened for modification	C:\Windows\dev4DB9.tmp	MSWDM.EXE
File created	C:\WINDOWS\MSWDM.EXE	jaffacakes118_Virus.Win32.Ipamor.c.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Virus.Win32.Ipamor.c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	MSWDM.EXE
2516	MSWDM.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2628	1176	jaffacakes118_Virus.Win32.Ipamor.c.exe	88
PID 1176 wrote to memory of 2516	1176	jaffacakes118_Virus.Win32.Ipamor.c.exe	89
PID 2516 wrote to memory of 5948	2516	MSWDM.EXE	92
PID 2516 wrote to memory of 2188	2516	MSWDM.EXE	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Ipamor.c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Ipamor.c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev4DB9.tmp!C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Ipamor.c.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_VIRUS.WIN32.IPAMOR.C.EXE
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev4DB9.tmp!C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_VIRUS.WIN32.IPAMOR.C.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2188

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JAFFACAKES118_VIRUS.WIN32.IPAMOR.C.EXE

Path C:\Users\Admin\AppData\Local\Temp\JAFFACAKES118_VIRUS.WIN32.IPAMOR.C.EXE
Size 96KB
SHA256 c47d6a3ffa451f943c0b166fb7f66df91f2e3c8d05b5a851cf22fb7ea2f7246e
MD5 c6baccda1abd760753d84c490d68880f
SHA1 52c326a82ae24e1e45ce318b9b62068f686f1699
SHA512 4b7fd7e0947f33afe945e59bda4f30bbcc4fcac77de6d260822ecc6cc8f21ba9cc0e66f03757435d705c30a0af7a24d6cee0dbd8b6a0250f427f90dff8de782a
SSDEEP 1536:2FbeITsAro5ZNjzFmAa6IBA2oESRAu0pcwuBiJR6:2FawsA+HjzFmRa2MAu+cJiJR6
TLSH
T19CA38C4F978FC3E7C354443C0056EB35D294EB29E117EE0AE2E1C767A8714C798A92A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 fefd7c95d5cc8b866cc966d25569d9b65bc1fd616e1736446621870b575786d3
MD5 c00dfda5994fbb80be922235b1c8648c
SHA1 71aa8b2b67f202d74afb3f77ce47f98e63a7e943
SHA512 34507e1858d8a84ed382f7d6fa1687361e20b978efd887340e03f1d91d522efb916d6429614c8096dee4ac7c73817f2e80cde5a0a12e85e9600bc7dc37195876
SSDEEP 768:2nFbeItJvR+Argv75ZmqPL2adWfwlmAa6BWRzAZ4qb1nYvSRAuK1:2FbeITsAro5ZNjzFmAa6IBA2oESRAu0
TLSH
T13E836A5F938FC3DBC714193D0056DB74D250EB1DE013BA1AF1E697ABA8704C788816E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev4DB9.tmp

Path C:\Windows\dev4DB9.tmp
Size 16KB
SHA256 27d6644771a935ec0547258dff56bbfba151f2addf09c51b1edc6a9a3207d2c5
MD5 8ad17f33bdcc0ea294e074e0e74cad3b
SHA1 81b4608a3e11a24157e9c22ac45ff1b12d8c476e
SHA512 f5337e5edc0386c597d8ae787e6f4a7fdac393d2aee55eb7b3a15cf82d9fb5757724d424aab0959a0c4ebf79c9cdd560d9157295a26edffe39ff6f056a526ded
SSDEEP 192:b16jkqnvSa3zKk93Vcy3PRC6eHXNaZ9DqW/zV/3sT1RRlaGVzOQX3iZznnD7N+O:QjkEvrescyPte3NaZ0T1RFVaQXSNnDR1
TLSH
T17372188BEE500033C1E481B45456BA7BE7EEC970232EDE86DB11C8626963D93B5FD213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1176-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2188-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2424-23-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2516-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2628-22-0x0000000000400000-0x0000000000414000-memory.dmp

Download