028e2d6e2d23ee0418d71911ca38345b19b88149214c4d23984b7cb23e55612b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe
Size 257KB
Sample260920-3dey6adh79
SHA256 028e2d6e2d23ee0418d71911ca38345b19b88149214c4d23984b7cb23e55612b
MD5 2a5273c9e7b97833e65493e75601d883
SHA1 5ea1564d743fe52b62b1032e2e877989effdeb28
SHA512 66382d076caf4b9df1cc1e111939b5b03daeb8df48052b0acda46d0dc17884bd77f96020d55d2987e3dcbbac4b0df5675ecdf983d5683d6ac3bd205d4eb83cce
SSDEEP 6144:IWfLLGq9YebsRmrYaDxBfWVm1H8nKPMLnqoanfJ:IWDLGQjB51HRPMLqfJ
TLSH
T1B344F106F7D380F7C8814F3048BE5B7AD83AFF545F71E24AC7891D696CB2512A419BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5060	tsksys.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\tsksys.exe	jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe
File opened for modification	\??\c:\windows\SysWOW64\tsksys.exe	jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsksys.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5060	tsksys.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 5060	4972	jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2a5273c9e7b97833e65493e75601d883.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972
- C:\windows\SysWOW64\tsksys.exe
  "C:\windows\system32\tsksys.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tsksys.exe

Path C:\Windows\SysWOW64\tsksys.exe
Size 876KB
SHA256 5eadebf1177f13c759da91b2eff8594d5dc8cbcb19b652346a0ef1021bd8665c
MD5 83e7b0997a71c0d21f06c39269de2066
SHA1 c9056bc34adc47d8d67407f5263096e9a738199d
SHA512 079b0fd65a06553075b52ea8725882d7534910d6bd675735f382f2661f017a453d3542b6897e4df662affe368db2cfd44dc0e73f0e92750fcaa44cd53f519450
SSDEEP 6144:kxyU894HMKb6gnzOfUohQovHEsr0nnfCSYDBwrL5d3jXElRMZ4M8hMP4NDETTq7C:ZU/RShd/iHL5d3jXElRMZ4ThYaNPRWP
TLSH
T10915A70F78F29084C0A950B8E714CBDCC4A55EE12722EAD72566F9E957FB9F0AE34503
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4972-9-0x0000000000400000-0x000000000041F000-memory.dmp

Download