Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 08:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__7fe1072f701c358a996be1db55a3dd13.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__7fe1072f701c358a996be1db55a3dd13.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target jaffacakes118__7fe1072f701c358a996be1db55a3dd13.dll
- Size 667KB
- Sample260919-j2l8laybke
- SHA256 86d883ea79547e3a9b3f9448d2e9e3b45da15b472a5c4bfb77e377e64a652a24
- MD5 7fe1072f701c358a996be1db55a3dd13
- SHA1 0edec23fdd9324adbc1598a5b724392c1d19828e
- SHA512 176e7d270594d407321cc16cadc75938c861ce6717f1bfdeca8c68033815948bce27b2259d6c67d34ac523fbc99e2c339b5d40997abcdd44c0423bc781d80d44
- SSDEEP 6144:EyxGL6yv9aouw2zTDQu3YjGdc07sjE+4aBipYufcikj/V9VfgOQDYBWP/H6qJNVF:gL6YeTMw8Gdc04VfJV9e3dPVJNqwoa
- TLSH T1ABE49D01F69289F0D70D25B105EE7739AB798B468F20CFC363A8DEAD5DB31A0A537116
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of SetWindowsHookEx 49 IoCs
pid Process 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe 6040 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4612 wrote to memory of 6040 4612 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__7fe1072f701c358a996be1db55a3dd13.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__7fe1072f701c358a996be1db55a3dd13.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6040
-