c6c355f135812aee4f017c096d4283b1d6564d2b33c5ba0df34e6fa90ea8f6c1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_PowerISO 4 3 lordyarox.exe
Size 6.5MB
Sample260910-exwt1sztfv
SHA256 c6c355f135812aee4f017c096d4283b1d6564d2b33c5ba0df34e6fa90ea8f6c1
MD5 c49ed6504bf949beb91961d3c2b21717
SHA1 5c2ac146a273f19e14895c236c91ebedec081c68
SHA512 94e1726545c201c9b39f7bbce0446c2ee937b54da718be127f562d6292a9b1a809836ccfc666c05d495c11db8f59b37b75fdbf7f5b6112a476be576f44cd3d8e
SSDEEP 3072:tqmsgIf0L/mUv1kPpJiQdQC0P+ievhPTzetmyYkvOs3Kqty+H3sUvUjQDBV+outu:tVsr0bmUOBpyTo7ibYkvd3KSyQM+uoSu
TLSH
T16E661211B42A8F05D6A5A3388DB4E1FE5C236C907B0C74617FC1F3DE46B3A5AA458EE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_PowerISO 4 3 lordyarox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3228	jaffacakes118_PowerISO 4 3 lordyarox.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_PowerISO 4 3 lordyarox.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_PowerISO 4 3 lordyarox.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3228-0-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/3228-3-0x0000000000400000-0x0000000000465000-memory.dmp