ee5846891d1ff7b3c8f9d0b83a7450b463680146b9f8e89beecd96e06a74c2e2

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Size 7KB
Sample260920-1blb2sdb93
SHA256 ee5846891d1ff7b3c8f9d0b83a7450b463680146b9f8e89beecd96e06a74c2e2
MD5 26da93809e3c69d0c65910aa93164298
SHA1 db6855c989f4c0c0c1898f08973c84b4cda23016
SHA512 7e774c981fa32c4d03d2713340b40a177fb421c01c53717d9ba4451c5b08448ab06f45015f6b83a776d4be7705d74a3309e460e5b11c1b902e0567cd36bbf651
SSDEEP 96:SD+B0/d+qOOHjye0L0OV6zK1oVMcqn4LMPlc6D0SAeKDW9jfPy1P:UXtO6j3VMT4qlnD0SSDW9jf61P
TLSH
T1BEE1D781C7538ABBE4520077007B9BBF93798677D31DA293EBB1E860B9F71E08055846
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Kuho_Install_Program.job	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	jaffacakes118__26da93809e3c69d0c65910aa93164298.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26da93809e3c69d0c65910aa93164298.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4780

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__26da93809e3c69d0c65910aa93164298.exe
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Kuho_Install_Program.job

Path C:\Windows\Tasks\Kuho_Install_Program.job
Size 388B
SHA256 1d8bb7bccf7dfc7f69f87d70cdb339631ce545a507fe70ea6e2dcf4f1b71b37e
MD5 fdf096228dce393d6fdd76ed54b827b8
SHA1 8d07e416f7a739f677dec7df5082b0462f5aa79e
SHA512 68f10d93ea58ee7814ebaf24368830d70d13940d5a11ea4ec1d2cfc62a88a2776c800a004e6f2182ae2ad7092dbef16a1a91097ffddc8af7a78472f452152700
TLSH
T1ECE086A86FD51030E77B4B33E6E152525774F45279215B0E414A42490C16A21DE11719
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1612-4-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4780-0-0x0000000000400000-0x0000000000404000-memory.dmp

Download

memory/4780-2-0x0000000000400000-0x0000000000404000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads