fe82fb431f032925a03798031a4de92a812606f81defe3f420344c8fc15d224c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 23:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe
Size 143KB
Sample260919-3yf2yscg46
SHA256 fe82fb431f032925a03798031a4de92a812606f81defe3f420344c8fc15d224c
MD5 303fc773c0eb898ddc6295944bbd5de8
SHA1 3dcef969be67f1aaaa3c489324de5b90c10ebd20
SHA512 a578007e9b24348be22c48844cad862b5d33dc6fc6c80de90b5b72a53ef69274418385cb09695ea5760025ad5ed7a7935e98daa85d2ecbc045f68741e09f7b7b
SSDEEP 3072:y74ZzTb0dwtlnj6LyUP/HGndVK9VAyzhF:G24Lb/qVauy1F
TLSH
T1DFE3CF07A6402595E0911A30996BC9E9AF63FC390F535DAB73A677CD2D31E008E1F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ogg.dll	jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1968	jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__303fc773c0eb898ddc6295944bbd5de8.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/1968-5-0x0000000000400000-0x000000000041E000-memory.dmp