0947a80956a6e31147a15f97d4bc1d03b1cba22b22453e3c1ffd726b7b302599

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_processed_batch_1.exe
Size 507KB
Sample260910-d9gp7aep6y
SHA256 0947a80956a6e31147a15f97d4bc1d03b1cba22b22453e3c1ffd726b7b302599
MD5 9838e50b0138e377086e19cf74fed56c
SHA1 f5ee35c7ea58107d1d830f3ae9e671b0f2995852
SHA512 6d1ae08d7c72e36e92c490119fc85cf855c3f28d8a718c0b93c2f41265cc3c7c219e1026f51c230b24f891b6ed70caacb21bd6df1486a9ca3443c24d801425e8
SSDEEP 6144:RPKgjvg547PdH9T4+w5ymGje7brQvVRcdruCgrqhCoG:Np7PdH90+8ZGUIvVCNetl
TLSH
T1A3B46DD37D52D326DC9A5AB6491B46328E74BD6A02040B76EFD132358A36CCFE52B70C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_processed_batch_1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe
4004	jaffacakes118_processed_batch_1.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_processed_batch_1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_processed_batch_1.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscA262.tmp\System.dll
Size 10KB
SHA256 ef63f2d4dc4ccb6b35449f56b19915a26ee6dc7089df01499f44da4db5ab1499
MD5 24ba3b21fe9c5d01a7c21d32958b3a16
SHA1 c25ac10843ae5ad73e57fc80585c0c3c924888e8
SHA512 5eae694d3b36757986ee583615ee672a41b8d806affe80b9591c72eae54373293be5875794d80cef3863cefc8dde44a7c88f9fe232af1e96d01401e0cce72f94
SSDEEP 192:nR9jFtTLkreShqlyXMUspRRFtvD4feuy9mt2h8pGfhnw:nrjy+2MFmfeuyaG5nw
TLSH
T117224C65439082F3D894823C1D627A371B7D362091F34E53EFB358D4DD6AA427E3A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nscA262.tmp\UAC.dll
Size 13KB
SHA256 86445396775370aff5834f10bda25e505b6f89efc69a04fe1ce46f5d128be73f
MD5 7f56c0d6a8733dec142814ed5a58b0ee
SHA1 c119e66f179cfb758966f3cf878466057bea1840
SHA512 8b3b9bed985b3583b7be8b2197bb068e5d5508f8b5c4a7fc1278b2662dc8d9a53fd6df63f636e44bfc5aa37f030ac76b8d259d6b446bf87d5c72b74ff5b158f3
SSDEEP 384:d/lNMKbnRWKYyCvDvQH3yBf/qPNGkVWYyLrcMf9VQ8c:d/lq+RDYJf/qPNGkQ5LrcCQ
TLSH
T1D8524C6666848BFFC741A235B69A373396F4D7606561A18FC9631DCB6971013BC3F302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registry.dll

Path C:\Users\Admin\AppData\Local\Temp\nscA262.tmp\registry.dll
Size 24KB
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
TLSH
T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4004-10-0x0000000004980000-0x00000000049D9000-memory.dmp

Download