Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 05:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_0203[ org].exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_0203[ org].exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target jaffacakes118_0203[ org].exe
- Size 10.4MB
- Sample260910-fp9xca1vfs
- SHA256 2d1bf9fb38053149533f8aa38345e2f12bbab7e242bd35a1d0560a6ee2904b70
- MD5 b7d0e6588cf333fe0ba4684e25e14863
- SHA1 7ecb1d3142fe07bc4397ef14c898bf73d20297cf
- SHA512 fcdb963491b80f3470063a61914c350b7fac0146e25482c0afe0d36fee48d730021fce1e66d3318347d06470e6ac5eadb270874f8c836ca2f9e1a61cbeb17e9b
- SSDEEP 12288:Yf//K/GBRLjhZDP4PyMRmakwVXF8ECC++nb3VfMjMLBdNs1g5GOw8KfgncPlqHvk:YX/KeBR/hly4YVYv
- TLSH T158B627391D6F5EE7F2E9CE31E5DC935138DB65322580B7AF7383020E066F581A4A8D1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2024 set thread context of 1972 2024 jaffacakes118_0203[ org].exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_0203[ org].exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2024 jaffacakes118_0203[ org].exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89 PID 2024 wrote to memory of 1972 2024 jaffacakes118_0203[ org].exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0203[ org].exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0203[ org].exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0203[ org].exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0203[ org].exe"2⤵PID:1972
-