Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 11:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe
- Size 8.0MB
- Sample260912-m39basvcpb
- SHA256 6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4
- MD5 5b2f3157c4585ec293586986c7771451
- SHA1 98fc8809c42de35885ed37a1414b79a0c57b7dbb
- SHA512 706abe615783bc91873f8b9b3156bb4b53052a568743c115f94c813a22f5e1edde5acfa9c4a9ed0f43b0d38759b78007d6ff04d2fdbbdb9b04c566b02ad964a0
- SSDEEP 196608:UKw82lZrTVHJack+3aNHnbCArjIsWlGlSRRbC+8:hl2lpacJi7CAg5lTF4
- TLSH T189860137F0DA2471F8332A36A8A25062393E44DCE087296929F46BD7F572D4D8F4B791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5796 javaw.exe 5796 javaw.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5880 wrote to memory of 5796 5880 jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6fa9963bafedd6ea6cafd19a87c934089136b1e43b3fb0074eed99b5d824b5e4.exe" org.develnext.jphp.ext.javafx.FXLauncher2⤵
- Suspicious use of SetWindowsHookEx
PID:5796
-