298fb9de3c726f8d610a7c101660da9bcb21b6e4833dd19dfc026c8a8bad6097

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
Size 796KB
Sample260919-3jbtpaybmd
SHA256 298fb9de3c726f8d610a7c101660da9bcb21b6e4833dd19dfc026c8a8bad6097
MD5 2f7d42e3a9120b75752ac5150336c3b6
SHA1 aaae8afe5cc7f5bfeeb21d4022f292b3a890b428
SHA512 dd30e1e27aa62331c5fdf81ed7c29c4ff511b9e242e45368bb6840eb92ea9bd0b58c5db338c84f3b9f3825c658fa04b5b774c8270781deba6db90a5be131a158
SSDEEP 3072:a+FYdNtKonvVIm63kvuZd5JFJHwxejOyKfSPG5cDTvKEnv9IYp:41JIn3kWdDwMjDYSPGiD7VIg
TLSH
T1EF050C3AEA296437D3B58339E1D1812FF1D5AE673A01EC3F98C353C21529582BAC654F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5532 set thread context of 3372	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe	89
PID 5532 set thread context of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 set thread context of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 set thread context of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 set thread context of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 set thread context of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5532-0-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/5532-6-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 3372	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe	89
PID 5532 wrote to memory of 3372	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe	89
PID 5532 wrote to memory of 3372	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe	89
PID 5532 wrote to memory of 3372	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe	89
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
PID 5532 wrote to memory of 0	5532	jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2f7d42e3a9120b75752ac5150336c3b6.exe"
  2⤵
  PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3372-3-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5532-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/5532-6-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads