Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:59
Behavioral task
behavioral1
Sample
jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
General
- Target jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe
- Size 202KB
- Sample260920-31zbbaec39
- SHA256 24cb434e591961a2983de19ab9829f6eefc41cef55cbee196e4e67438bdc9825
- MD5 162724e35d61ae54d7c4353e740b0d1a
- SHA1 2c8fdd641233023766299161e78830f6806688e8
- SHA512 0f6436281648d3e3369530ca9ec3ec7dcafc730cdf2a0e1b0b8203a715205d6f74fe6fa49f445f8c65f09b8856c27be7779a96f487738a5c51d15709287b5705
- SSDEEP 6144:OZC4d3lbxc6wU/UP+XhdMRFD3LAwektHoSAf:34dMRU/UP4heFjLDFtHoSA
- TLSH T18D14123FD71E602DE9387135871B2A18F424953D8C384DF260832A6EA736F5DD98E369
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4324-0-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4324-2-0x0000000000400000-0x0000000000474000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4324 jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__162724e35d61ae54d7c4353e740b0d1a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4324