Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 14:30
General
- Target jaffacakes118__9909793e1938f8e32f7a43fe7b1d956f.exe
- Size 939KB
- Sample260919-rt4rns1hpc
- SHA256 139937c8a1c2dfb2971bbc640eb1d8ab79621dfbf7bc140f35bfb14ad67511ab
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9909793e1938f8e32f7a43fe7b1d956f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9909793e1938f8e32f7a43fe7b1d956f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SVCH0ST.EXEC:\Windows\SVCH0ST.EXE1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SVCH0ST.EXE
memory/4716-3-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/4716-5-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-0-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-1-0x0000000000950000-0x0000000000951000-memory.dmp
memory/4916-6-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-7-0x0000000000950000-0x0000000000951000-memory.dmp
memory/4916-10-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-11-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-12-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-13-0x0000000000400000-0x000000000061DD25-memory.dmp
memory/4916-14-0x0000000000400000-0x000000000061DD25-memory.dmp