0c39048805f37049ce11014ecce56f0fd08a08cda47117cda79743d9ae6e20c5

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_12Ghosts SuperGee 6.0.exe
Size 5.0MB
Sample260910-dc91gadn9w
SHA256 0c39048805f37049ce11014ecce56f0fd08a08cda47117cda79743d9ae6e20c5
MD5 8be9842640ec791360a75595e91da081
SHA1 29e4a579374ca1bb993df33dfc1fdb9f1568a5db
SHA512 7cb94ab4b4c0ff4ac2f6ac5c21e165477ad57922297145021075f3d8ed806cd87891b8bac9c577c961e9c39d97dad2e1819ca64782f187968bcd19da0455d43d
SSDEEP 12288:J0ikd0C0VClRRbB9/m57psGs/B2elQm1rP:iiIgVORbB9++lD
TLSH
T1E236BD5A1B6B55FED13CF8F08B91992EE810AD262ED05B6321CE390F1D71C8F449E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_12Ghosts SuperGee 6.0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2596	jaffacakes118_12Ghosts SuperGee 6.0.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89
PID 2596 wrote to memory of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89
PID 2596 wrote to memory of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89
PID 2596 wrote to memory of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89
PID 2596 wrote to memory of 6104	2596	jaffacakes118_12Ghosts SuperGee 6.0.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12Ghosts SuperGee 6.0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12Ghosts SuperGee 6.0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12Ghosts SuperGee 6.0.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_12Ghosts SuperGee 6.0.exe"
  2⤵
  PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6104-2-0x0000000000400000-0x0000000000452000-memory.dmp

Download