6467d62ca22d793b3e6e38d66bc546644767496801b0bf1121d8e63be910504a

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe
Size 900KB
Sample260920-1lyecsen4y
SHA256 6467d62ca22d793b3e6e38d66bc546644767496801b0bf1121d8e63be910504a
MD5 2768bf660e6b515fe58ac0d67ffef10a
SHA1 ced026d1763e0c35cca80c07282caa7216ffc518
SHA512 02700249227dc5f3589e986141f3799ae31021ca6d80d528778725408c52f0584ed4d4a9b248d681b5f62763c8877e932d9648f0faf106109036699411959e68
SSDEEP 24576:fJOpm3+x5s9oaRCueNebcRbfM7gXGKDMz4KXUT/A:gpmubs9o0raKoGKDMMG+A
TLSH
T18915331BEAB4DC63C5DB8EB2143E7B1BD6A5CC34C16C299B93EC5F2D5E508228047662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2680	Scache.exe
3352	iepsetup.exe

Loads dropped DLL 2 IoCs

pid	Process
3352	iepsetup.exe
3352	iepsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Scache.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iepsetup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3352	iepsetup.exe
3352	iepsetup.exe
3352	iepsetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 2680	3168	jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe	89
PID 3168 wrote to memory of 3352	3168	jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2768bf660e6b515fe58ac0d67ffef10a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Scache.exe
  "C:\Users\Admin\AppData\Local\Temp\Scache.exe" -pagoT3RE954jwq32qt -s
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2680
- C:\Users\Admin\AppData\Local\Temp\iepsetup.exe
  C:\Users\Admin\AppData\Local\Temp\iepsetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Exec.dll

Path C:\Users\Admin\AppData\Local\Temp\Exec.dll
Size 125KB
SHA256 4d8399cfa17372a321e6a19a564142697cc54244747bde8e3457dda734b71ca9
MD5 96cf354853b0ee025235056b658dd6fa
SHA1 5442809ebde80b1f3c627a7adeb2de8fb96f463c
SHA512 cefe831b874eddf20eb5da744a006a496664c1e236c757fc92a051a3712888fdec4a291dfe8cdc3f04bc5a18dbefcd5e9cff6b76bda0fe856035260faad30a8e
SSDEEP 3072:Q+7O7NVRCjsRM8AkMSsVrDOaYbuMTo7WO4pASFZUNIo6:5OHRCj4hAkMZyRqoJj
TLSH
T178C35B13B1D18871E1711E7CDC6EA6A9983EFD922D78219F63E82D4D4F7D68128683C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Scache.exe

Path C:\Users\Admin\AppData\Local\Temp\Scache.exe
Size 908KB
SHA256 1df5f7af0feaf6c80f0db64e73b21798d0fcd18e3213b8ea9be94bd74049bc4c
MD5 ce9f61ec390f07562d909ac4d879e295
SHA1 a5b62f83a3592990d5760bc1661ec6dc80d41584
SHA512 de1337e093e7650fdef7fbe1cccf93c621a6859830458cb0b57d6bcc4faa19a4995e38f2654f8f1e3acbfe2708f90b0d87ce33e38ce841163c8db9314add4364
SSDEEP 24576:IIq1y2m30TiQOoPFCue6epfRxfqUWPKYUiM1:IIUtmkeQOo9r8h8DG1
TLSH
T1C315232AB785C4B3C4894A312C6E7367D1B8ED31E6743597F7AC9F2C1D700629047ABA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iepsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\iepsetup.exe
Size 1.8MB
SHA256 3c1b7532b9c41f0cb0a11a2524e7f6854c49672f6ac883a1775656e373384bfb
MD5 2e9fbde227d4394f2789e9beaa8db8ed
SHA1 b506cd7225aad02ea6df7bce6243c525c4a6bf8c
SHA512 5754c2487e71fc3373b7473aabcac92ab700dcfbd5f7a0031701cfd0be50a4c22ca5ebb74166ff09cd3b0f3fcea1a4f9671a36deff99309165ff883d4a2d717c
SSDEEP 24576:9IQBXMj8YPkEEo150JjKFddTX9iKdqHNt/bxK4JJfWpdWrUsIIeuEDaSH3FNu:9IHwo1H9X9iKdYbxZfWzWrUsINN1A
TLSH
T128958E33F3828437D1732A3A9D5B97659829BF502E24688B2FE42D4C5F397817C292D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2680-9-0x0000000000400000-0x0000000000423000-memory.dmp

Download

memory/3352-12-0x0000000000599000-0x000000000059A000-memory.dmp

Download

memory/3352-13-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/3352-18-0x0000000002450000-0x0000000002474000-memory.dmp

Download

memory/3352-19-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads