ec5a559c4c541c52593139e5cf3774c2451a43c3b4b1a26ac74d4797a75a1f73

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:07

Target
jaffacakes118_1337 Easy Hacking 1337.exe
Size 620KB
Sample260910-epzwpsfl5t
SHA256 ec5a559c4c541c52593139e5cf3774c2451a43c3b4b1a26ac74d4797a75a1f73
MD5 a94f2339e164e004ef1988f30d2f2c9e
SHA1 cda49352d81d431b89b8020ab728df3bec7af23c
SHA512 7a8cf1d1be42cd24cb8f06c7d5c14bbed8cff85d93207cfb4cf37d37aa26809f863a0cfad892271e9dac172c05225cbd5be22cce7619d884d3c9fd1974825633
SSDEEP 6144:KryT1J/oAuPjLPXODWLmNQ68WOP9shFX+5s/IYcGW:UK1JwPjLeDz2fWOP9rsFcX
TLSH
T1C9D4F176F9D69CF0E30BC232A765F65DA2213D63EFC3067001E0F2954D35B618A6AD86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
1556	netsh.exe
2332	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

Windows Command Shell

pid	Process
1464	cmd.exe
772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1337 Easy Hacking 1337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1264	jaffacakes118_1337 Easy Hacking 1337.exe
1264	jaffacakes118_1337 Easy Hacking 1337.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	jaffacakes118_1337 Easy Hacking 1337.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 772	1264	jaffacakes118_1337 Easy Hacking 1337.exe	89
PID 1264 wrote to memory of 5776	1264	jaffacakes118_1337 Easy Hacking 1337.exe	90
PID 1264 wrote to memory of 1464	1264	jaffacakes118_1337 Easy Hacking 1337.exe	91
PID 772 wrote to memory of 2332	772	cmd.exe	94
PID 1464 wrote to memory of 1556	1464	cmd.exe	95