fb8e3b08df9d2eb32778fb9e655a2655cafb21955b2922adff540dd715cc268b

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/09/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe
Size 159KB
Sample260918-l1995sshjb
SHA256 fb8e3b08df9d2eb32778fb9e655a2655cafb21955b2922adff540dd715cc268b
MD5 f1f27194d2a3241c89b1f69cc7e297b8
SHA1 5da26b965b7f3a40a2f93ff95e12f781f5dd2eb6
SHA512 a327aacbdaf49f91b15675d0e41a72dc413190adb85d2d0e12e0fe97fb1d1ff9b8d73a3781117a73d699079223913554a9f88c531980e05a8bab0125b625a896
SSDEEP 3072:DwZQ5RyoN1CAErL4X45afqiJOjA35+X/bahwWsr:DTlXEQX4gsE+XDqd
TLSH
T11AF3D03FE7A0A064E15C49F14A7D1C6C1935B046C42FEB5763DC1F8E6E71EABDA0A202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2976 set thread context of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ P:\1vrgKfefdfHgB3d7v7.txt	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90
PID 2976 wrote to memory of 6084	2976	jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__f1f27194d2a3241c89b1f69cc7e297b8.exe"
  2⤵
  PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eYdW8ae54dqjE6aVew.tmp

Path C:\Users\Admin\AppData\Local\Temp\eYdW8ae54dqjE6aVew.tmp
Size 3KB
SHA256 00329b987e6741d18f62d8596a5f1222893b5f28b4a0f3190c1a899ef47c8bec
MD5 e2b92a2d8248319df514ebb424bf344f
SHA1 747739611d732e72382c9b56e6a83db77b07087d
SHA512 3d211e9846ff5add6459d515b603d6d5f4a40fdcc73e980161853b9ee9c8dd054dcab709864eac98f440c4dfa085207b829789efac4207c9241788553d6785be
TLSH
T1FF51654BB7124CB5E4D5033489F7285533B70136A3A34029498E2A29307EBF5A629ED7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2976-0-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2976-9-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/6084-6-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads