Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/09/2026, 23:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe
- Size 892KB
- Sample260919-3raxcsgn21
- SHA256 e0b0014edc395bb378086a45978bc9a00fb4b08e26b695e85911fc04a6143a6b
- MD5 2fdf656b4f4422ac92494a640a01e367
- SHA1 2bf127cc8ca00af4f623ad8dc8fe407e58ab4031
- SHA512 8fddd97b698a9d4fe087b1791a80bdd70d38b63a1f86f2109540a9eee0877b17f8d658c2a69f77a87dde36516680bb76b7a12e00c86b994b1363c93442ce6a67
- SSDEEP 24576:1QDNnKj5LsqzWwz3Ld/A/dnj2xnRyhgo4Bhl:1QDNnzw/BQdsyaosz
- TLSH T13515238312C19067DB6B1D300D378D1F5E3AE4238DB50F5BF7A8B2DE589A7B25DA0258
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4504 jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4504 jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4504 jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe 4504 jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2fdf656b4f4422ac92494a640a01e367.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4504