Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/09/2026, 21:33
General
- Target jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe
- Size 226KB
- Sample260920-1ejbvsem41
- SHA256 e1440cfad57e70a71bff1bdd1a7b7d0b691df5e013ac77f82c7d5cf9e2f77fb6
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27084c85358254c39e7ec1a0ffd51fce.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1236-12-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1236-13-0x0000000000400000-0x0000000000408960-memory.dmp
memory/1236-16-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1236-19-0x0000000000400000-0x0000000000408960-memory.dmp
memory/1236-20-0x0000000000410000-0x00000000004D9000-memory.dmp
memory/2016-0-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/2016-7-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/4828-3-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4828-5-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4828-9-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4828-18-0x0000000000400000-0x0000000000472000-memory.dmp