7d4a255ddac09adb1f793673022ede1bc69ca61fae0510572bc46d8b3daf8d6c

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__9e15ed7badb017a65d31d63ffdca6f6a.dll
Size 54KB
Sample260919-tle5fsshpg
SHA256 7d4a255ddac09adb1f793673022ede1bc69ca61fae0510572bc46d8b3daf8d6c
MD5 9e15ed7badb017a65d31d63ffdca6f6a
SHA1 f8a3ba40d4307a52b61253cfc45cc5a669f8a955
SHA512 04b7a9759094fca2d227db6896e7aa35f045226636d8ac987919f5aba19da4fd67c2bacd819590b55d4264ac86cb36b267d242a8fb5368f81fdb0b335ad0e806
SSDEEP 1536:NixOYKm7+NcP6Uar98epB8V7C6+7HHz0RZ:Y9+NX5ZcO7nz0RZ
TLSH
T1A543010CDF0A3E44D792B2B20EDCD1B42DF379556389C78E2794E47F6A63301A22666D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4572	3328	rundll32.exe	89

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9e15ed7badb017a65d31d63ffdca6f6a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__9e15ed7badb017a65d31d63ffdca6f6a.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4572-0-0x0000000075210000-0x0000000075235000-memory.dmp

Download