Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 10:51
General
- Target jaffacakes118__8e13d4cf43b8f79c365feb000f40174f.exe
- Size 255KB
- Sample260919-mxt97azvc1
- SHA256 350d8e8eba6f89cf7ac057affee6f82f9e0dc374108853833423d139cec1ba84
Malware Config
Signatures
- Suspicious use of SetThreadContext 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e13d4cf43b8f79c365feb000f40174f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e13d4cf43b8f79c365feb000f40174f.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e13d4cf43b8f79c365feb000f40174f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__8e13d4cf43b8f79c365feb000f40174f.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3220-34-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5080-28-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-14-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-17-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/5080-26-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-25-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-24-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-23-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-22-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-21-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-20-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-19-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-18-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-31-0x0000000002420000-0x0000000002421000-memory.dmp
memory/5080-30-0x0000000002430000-0x0000000002431000-memory.dmp
memory/5080-29-0x0000000002430000-0x0000000002431000-memory.dmp
memory/5080-0-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/5080-15-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-13-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-27-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-12-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-7-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-4-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-3-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-2-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-1-0x0000000002430000-0x0000000002431000-memory.dmp
memory/5080-11-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-10-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-16-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-9-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-8-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-6-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-5-0x0000000002440000-0x0000000002441000-memory.dmp
memory/5080-38-0x0000000000400000-0x00000000004A4000-memory.dmp