2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7.exe
Size 24KB
Sample260924-2fn46stdlc
SHA256 2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7
MD5 9ce22235ecb84af43829408eed7f3771
SHA1 aa292160ef56c65aec02c57bb25fe3edfb3eb858
SHA512 637b3016c8bfddf361b2ce02ac555219a0607ffc19aa16e884a3f6dc3933f5352d0442562d3db1f91887901a0bd854dd9306e056e2d180e0f0ba9e347938712a
SSDEEP 192:i1lzqTePKyyATpaDmZ18h2NioeQ74HcMBmoHWzu:EqTeSyyATpa7sReQkHcyHWz
TLSH
T18FB2A673BA808164E659577158E3C3E79A673C3A0F0B0A0B71883B5E5C75F918D66B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1768	jaffacakes118_2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2fe947d4325678c774bd01cbba5ac190504491685155e34b6cc113a3883fd4d7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ljysba.exe

Path C:\Users\Admin\AppData\Roaming\ljysba.exe
Size 3B
SHA256 2f05d4b689d270cafb02285f35f44866f7dc8a2d368a3f9d1124373eeab31fb1
MD5 bae60998ffe4923b131e3d6e4c19993e
SHA1 1902e3d6fc4e78a0bcc50ba12b882769afbf4a8c
SHA512 cfd4aeb37e86243d2fb115e715dca3b870c1cd319f6b3f2bf0ea62e711ecd88f3936c6086cfc320659707f92d6e17ead37e5d339d5df9f896c44bd90c06d2b8e
MD5 SHA1 SHA512

Submit Download