331c11997bec84934e089c8e337c976086880b588eec4711f0a37f2fbf425f1e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe
Size 47KB
Sample260920-2a95fstxcy
SHA256 331c11997bec84934e089c8e337c976086880b588eec4711f0a37f2fbf425f1e
MD5 288b3a69f37f1aeaf30753a8b87ee0c6
SHA1 7c6f419eb96a24cfe81f0ca20455b84bbe65edc5
SHA512 1ea686e8d5646311f981421ae8fc5113793f475dd5d24042662cc7607a72bed2214a9c70e1bfa78e729c480635a5ce62cfd219d6ab0bd13b1caaa5bf21fbd277
SSDEEP 768:WHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJs8mE5GZNh+xnK42gh:WpgpHzb9dZVX9fHMvG0D3XJjpkbh+xnV
TLSH
T1E023D01EB6C08DBBD59206710AB7A339F7FBC1CA11625E0B4BA41F6B3D3114789055E3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5476	Shell.exe
3560	ShowIcon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShowIcon.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5476	Shell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 5476	4516	jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe	89
PID 4516 wrote to memory of 3560	4516	jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__288b3a69f37f1aeaf30753a8b87ee0c6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Roaming\Shell.exe
  C:\Users\Admin\AppData\Roaming\Shell.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5476
- C:\Users\Admin\AppData\Roaming\ShowIcon.exe
  C:\Users\Admin\AppData\Roaming\ShowIcon.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Shell.exe

Path C:\Users\Admin\AppData\Roaming\Shell.exe
Size 32KB
SHA256 95e35b44e008638960edf83f37ee9ee9f97452bf296baf93bbebf9f009cf58a4
MD5 f4ccc16a58b1cf333d49b5e0ed317d93
SHA1 f0ad94724de490b012365d948efb118226acf0be
SHA512 be47c97711fe5ff3fc9f8af415aa16c62566982c749925133fe3f893deecea1f7e45ba5f4debf0ea5f39da979fccca34d492fbfa2f19ebf1b274733ea503c2fa
SSDEEP 192:/TzSc+OLmUNi164TnbCqZCr4kWNIUJodRSPvaEGGPzAUT/U8zk8aPT7Pz2AgmMko:/THfL03bCqdIFaGUziT2AgmMN7ENMl
TLSH
T1B2E2EC298E0B1063F5514D718AE906F50FBE6C137593AE2FDF46E91828F064B19F0AF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShowIcon.exe

Path C:\Users\Admin\AppData\Roaming\ShowIcon.exe
Size 15KB
SHA256 924ed8585c096f2d9c6e2737f6a57ab44abf977751684316740144405d246a94
MD5 0b14985e5288de033a12cf61fc8269fe
SHA1 21d7f76ed9a18d59edaea7ac8fed5e8617986735
SHA512 3ccf05099a4660635be4adea64acb4b4bf392fcd25dd58552ac9369b6fbdfcc6d3063dd0a7deaa65b0d1499601f8a056f1788ed4e3f20586f821d239ed29a318
SSDEEP 192:3nzoamz8YezTW0WVubBBFdQs7KpAz/5JiV0+dWH+VIbAA7y+xHdJRUoAiV5wGyRU:3zoaX360WcbBHkUBJ0mxuD3W4bSymX
TLSH
T1DA62F937EE3D4952F68D81F2053B4EA8081B76703545492BA69BBA4C6D39F407E25F0F
MD5 SHA1 SHA512 SSDEEP TLSH