121857160502e7ec0c35220e323f8b41e86bbba2e6a8a8d3abf7e5e0269d6554

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__af01e9aa204670ed1c1a7c381e689324.exe
Size 122KB
Sample260919-yn2hpabe69
SHA256 121857160502e7ec0c35220e323f8b41e86bbba2e6a8a8d3abf7e5e0269d6554
MD5 af01e9aa204670ed1c1a7c381e689324
SHA1 299f02e7f0ea00358eb02941a43f5e3bb8b74738
SHA512 329166f30a5ede3d8e93b22adb113a2630b568cdc01615d16d5be49ab5f17ff4346fbfb498991e2f3e011420bd63ac629ff69c4a3267e56af4ba6f4b2cb71634
SSDEEP 3072:vxu/Dl5o77acXN/B61z5JU8g3wOJyZ9he:ag77DXNW5JLg3PJyZG
TLSH
T163C38D23B8D1C072E12600B58892C677A967F878AB761D873BC8556A5F365938E3C70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__af01e9aa204670ed1c1a7c381e689324.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__af01e9aa204670ed1c1a7c381e689324.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__af01e9aa204670ed1c1a7c381e689324.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5432-0-0x0000000002180000-0x0000000002181000-memory.dmp

Download

memory/5432-1-0x0000000002180000-0x0000000002181000-memory.dmp