833d29642bca3de2a36b9570b3b0ef1c36ea34d613aaaa2c273d1b52b0e3cf0c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.FakeAV.nmoy.exe
Size 404KB
Sample261018-x9vftstyfs
SHA256 833d29642bca3de2a36b9570b3b0ef1c36ea34d613aaaa2c273d1b52b0e3cf0c
MD5 a1be63e41e001ee653141541754938b9
SHA1 e658aaa7295a9baefa9a6a5f8febc20d6891839a
SHA512 6dadfe479806098252a97702c370acdfbe5698a725c7f8ef703c5daec930aca4459d10d50da9acbc248d79711406802cc5c516b4198398ea7e6b42ad5f94b746
SSDEEP 12288:lWOBaW4NghEdNDLkyZ5Ia+JzcbtUgBByPE:DBalghEdNMhagcbtP6P
TLSH
T1DF9412DF36C3D4E6CA716CFD166E814A581F6C4E049E50CE2C12B2376BA26B78C6614F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2344	4592	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.FakeAV.nmoy.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.FakeAV.nmoy.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.FakeAV.nmoy.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 516
  2⤵
  - Program crash
  PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4592 -ip 4592
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4592-0-0x0000000000670000-0x0000000000674000-memory.dmp

Download

memory/4592-1-0x0000000000400000-0x00000000004CA000-memory.dmp