e491d28be7433b98ed298c56e5e200d25cccb27b1007e9213d4dd1adaa3a3e20

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/09/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe
Size 236KB
Sample260917-3ynf2aef58
SHA256 e491d28be7433b98ed298c56e5e200d25cccb27b1007e9213d4dd1adaa3a3e20
MD5 d35f77b2553ed0c4f279a4d334302dbb
SHA1 7eba7ca611160a3b114af104fb5101fdc332d5d8
SHA512 f2d4dd8e8239835aae53f71d5962659d5431d0678a532a1df9959c086c3bc6cf209ce965c0521515849e528eaa891dc7132739d7d3bc42b87d550738ad043ae8
SSDEEP 6144:3+af3IsaPArrgDd6toYZrlk0vs1SVzQRo5p:3+I38dYpBkS+c
TLSH
T1DA34F1ADF905E0E4E0E841BABD22D5A9A935BC1FEC411D3B70F57F9F78B9211A0214D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2908	X

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4164 set thread context of 3856	4164	jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2908	X
2908	X

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1720	explorer.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe
Token: SeShutdownPrivilege	1720	explorer.exe
Token: SeCreatePagefilePrivilege	1720	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1720	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3856	4164	jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe	88
PID 4164 wrote to memory of 3856	4164	jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe	88
PID 4164 wrote to memory of 2908	4164	jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe	89
PID 2908 wrote to memory of 1720	2908	X	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1720
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d35f77b2553ed0c4f279a4d334302dbb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\explorer.exe
    000001F4*
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\f86da51e\X
    193.105.154.210:80
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Local\f86da51e\X
Size 41KB
SHA256 fcfbb4c648649f4825b66504b261f912227ba32cbaabcadf4689020a83fb201b
MD5 686b479b0ee164cf1744a8be359ebb7d
SHA1 8615e8f967276a85110b198d575982a958581a07
SHA512 7ed8022e2b09f232150b77fc3a25269365b624f19f0b50c46a4fdf744eeb23294c09c051452c4c9dbb34a274f1a0bfc54b3ff1987ec16ae2e54848e22a97ed64
SSDEEP 768:kfEyKizYbbZzzASzQP1MmYkYlIAMtG+aYVSlTAdSv8:cbKizYbVvmFY7MtxSv8
TLSH
T15E137CC1A3A510D9D39BC17ACA772E27EBF1B8650A14A71F07118A751F337629E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1720-10-0x0000000000920000-0x0000000000928000-memory.dmp

Download

memory/3856-1-0x00000000007B0000-0x00000000007C2000-memory.dmp

Download

memory/4164-2-0x0000000000A00000-0x0000000000B00000-memory.dmp

Download

memory/4164-9-0x0000000000400000-0x000000000044B000-memory.dmp

Download