ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec.exe
Size 105KB
Sample260924-2ae93stcma
SHA256 ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec
MD5 2bde9505525e147dd3015ac972c17208
SHA1 bf0661fa45ea0ced3076cd4a87a5b006d4805fcf
SHA512 bcd35f8d8ec7d835451f02d32be800a19c91c6e3055d14959e18c5a6f372e00dfda23ac6f8b7ab74aa0dad4e024cb295cdcc5ddefe2f9e9265c966a4ce40a18f
SSDEEP 1536:+10aCK8m1+zBSbwojtXPvIOWFnToIfj1J8SS9SWUzHqTMGd2:+10q+zRojFPhWtTBfj1VVDoH4
TLSH
T1C1B3B02298C182E7D474957090FEDB3D9B277D3E0A865A4BB3C8F667243219572303EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ffa5ecb20d17abc8062ddf1cded8eebb1edaff13b877c8bc448d5fc7c305b6ec.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HA.EXE

Path C:\Users\Admin\AppData\Local\Temp\Temp\HA.EXE
Size 24KB
SHA256 86668d6707045572bffe2ad9538a8d40c217ce3eebb2689a5f97157c806fb54b
MD5 db409602f7e40d7032acd8cd85085d4c
SHA1 ff8d9484c93c359bc9eeaa48672469b6d5a10213
SHA512 126339cc0ca872a20dc81a12fd96ae9481a9e1436cc2aaa758a2cf1ddb4a823d8837d6a8ec2ccf0a9a83b1b04fd8096bedb333181f70780a85923d6a9b9f8685
SSDEEP 3:q/pzhlM+dl+dkluldlAQllK9tlllNTLXTPlt0:q/u+n++wlAQ/aDTPX
TLSH
T18AB29217113C7B00C28F103C25C97540F23589038A6096839E1E62F2C3028192808195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

corsco.exe

Path C:\Users\Admin\AppData\Local\Temp\Temp\corsco.exe
Size 15KB
SHA256 ec0acda2abd3baeb6053ed0be8800b051c734169eed6fa0a9258f998cedf09b7
MD5 b4242fab714a8bb3ce0641b79fae29af
SHA1 b359a15a48e19afaebe1c5fdd5a3d4bbe589c923
SHA512 579007064b2ba791402b28c0e5199ce072b48d93bce61e38cd171dbd5e772303e52947282baf5fe234c18ab776cff7b083dbe2bf8a62869d07356c1c471ba32c
SSDEEP 192:/YILwh1NTI5xY9goiPDXtY15paNKyXw5/b1v51PNJT:QFHTp9ZiPDX+15pQeRvP
TLSH
T19F62AE992DAD7B82C47DC5F262C84EC1B455C87A3F93E13A42964B445CF085FC2919E6
MD5 SHA1 SHA512 SSDEEP TLSH