46126a68e66fba681493314015e11a3c1145a08b1b7e936bdf3933b79643cf62

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe
Size 42KB
Sample260919-temkysgh96
SHA256 46126a68e66fba681493314015e11a3c1145a08b1b7e936bdf3933b79643cf62
MD5 9d80376024d719d40ae625eee67e6b48
SHA1 57abd53c8753c30f4611cb2d17fc3bfc0aad4513
SHA512 5d45af6286dfbb5daec10e72f19ab59b908b5a7fe820a6dd9e32412b09dd0cf5a1a608f191cf95b76e398cf038d1bbd52d918e4ad84793bc09a16a395dd41d41
SSDEEP 768:DGetq5QlwmitveSHKyxmjSJFOtqDdQLK4ShwyMlg:Ddtq5QlwVAKPatq5QLKziyUg
TLSH
T134135C8BB5D1C8B1D066DEFC4C16D28DA73736302D6518A6B2A99FCCDDBE389081C15E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\svchost.exe	jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe

Executes dropped EXE 1 IoCs

pid	Process
4860	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Windows\\system32\\drivers\\svchost.exe"	jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 4860	5392	jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9d80376024d719d40ae625eee67e6b48.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\SysWOW64\drivers\svchost.exe
  C:\Windows\system32\drivers\svchost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Windows\SysWOW64\Drivers\svchost.exe
Size 19KB
SHA256 5f8dd24eea5f2d1a4ea235d142fe4103ff83363e0c49a003cceb731de1cf6986
MD5 92df6d95719b287a845fb9c0bb384ebb
SHA1 fdc60511ec7c2bc1f2ac75fe5c26e1c141b43319
SHA512 fd3a38b3e56fb762f258db6a9a31f052d106970557478d6c7598fdb1afa9ad1dd67944dd422a2e7c71fc43ff961c5355ce49a1b33b6f268787d1f76ab9a3bcee
SSDEEP 384:U1OKY8ZOqbd1pZq8QX+5ItZu34BghsVHnyDkbWBaZ7Hni:eOtqDdQLK4ShwyMl
TLSH
T120924A96F1D2C8B1E111CFBC4C1AD219EB3B7A302E566499F5ED4DCCDE8E395241C14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4860-6-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5392-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads