ea84ca411a220e911491afc5e37fcfff0a9e35885556fad2977aa5bb64e110b7

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__91332ae253ab04a82e9f5524fa652a1b.exe
Size 39KB
Sample260919-n28ttazepa
SHA256 ea84ca411a220e911491afc5e37fcfff0a9e35885556fad2977aa5bb64e110b7
MD5 91332ae253ab04a82e9f5524fa652a1b
SHA1 5365801fc78a657cf7ee75ae6d278b856cce8f8e
SHA512 2bf13f712fa18085054bd8d63e995eecfc503eee4e959074014488d1b2f8424d7d9c00223ab1827840cbd92b995a9d9ba730c047ea3355a834fe34b12afda838
SSDEEP 768:/RpzBWTch9NBOUsunzlVlLx2/CatUUfcU9CFBWrtnEt97y/JnPe:/RpFW3izN9e/JnPe
TLSH
T1EB0383BEB7019039F0558AB6380681BD41DF3679147D7222F78F53197BE32DA6AA0B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__91332ae253ab04a82e9f5524fa652a1b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5700	jaffacakes118__91332ae253ab04a82e9f5524fa652a1b.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91332ae253ab04a82e9f5524fa652a1b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__91332ae253ab04a82e9f5524fa652a1b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drsmartload1.exe

Path C:\drsmartload1.exe
Size 114B
SHA256 6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
MD5 e89f75f918dbdcee28604d4e09dd71d7
SHA1 f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA512 8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
TLSH
T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AAC5
MD5 SHA1 SHA512 TLSH

Submit Download