b7feca799f27387c49dd73e9d649fc15d77a8ce0c6e9fa97f0051729c9cc4971

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__156716a4d535a02fa56ccc4f94770152.exe
Size 68KB
Sample260920-3pht7avxbs
SHA256 b7feca799f27387c49dd73e9d649fc15d77a8ce0c6e9fa97f0051729c9cc4971
MD5 156716a4d535a02fa56ccc4f94770152
SHA1 0151bf6cd41339bfcb14d246b750eba4b58dd4fb
SHA512 975e571df2da796221c1c8542cf9ccf75b4f1e8147df32e337845b98f2492a1a9253ed3f5c755275598f86bdb11671a4ebfcd172f27fb6a030e20901b62b3b86
SSDEEP 768:IfAIeBu1dnOgk4EuxHshXuyhbzW9DqadG6++tQYa3E0LA3jnPvOKzRNGYK+m:IYJg1OAEuxMhXTmNquG9L0RTPHRNGYE
TLSH
T182637D1279C0C2BBD8805AF40575CB466B3B6511037052E7FF9C5DCAAB633E98A3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__156716a4d535a02fa56ccc4f94770152.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__156716a4d535a02fa56ccc4f94770152.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__156716a4d535a02fa56ccc4f94770152.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5052-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/5052-1-0x0000000000400000-0x0000000000411000-memory.dmp