Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 05:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe
- Size 778KB
- Sample260919-fwf8lsbf59
- SHA256 03d720da6473f7fbf0f4fec10dfadfc723df47ace16c81b88179d4f764ceeaf9
- MD5 6b67c68ab50c486771adb2bee203a965
- SHA1 e4b7d21a09deeab78d0f3555dfb2ea94d3bf2cd7
- SHA512 368b4d0f98e01c23685f311d6aa38f6861f1b73c30b16e34196820fb985026d7bace163aa59a022a3af876ae8b2a0c7c8cbf43e7bc5b2f5225db4f5c57b71cf4
- SSDEEP 12288:2V+ucbwG5byfqa+hCQW6/dtGGIQRoqc+cwVAQ5uVNq8myirC6/61sLp:G+tyfn+h/ttTIcoqc+NVP53Pi1sL
- TLSH T1D40511C21236CE86F7D0D4B09974C6CB5AF82D0A87E3697DF59C3618BB3D6633A09521
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass32 = "C:\\Windows\\system32\\lsass32.exe" jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1072 jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__6b67c68ab50c486771adb2bee203a965.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1072