1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f.exe
Size 59KB
Sample260924-3q37hsvcrd
SHA256 1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f
MD5 9f2bfd6e2e766d3571520bab89315280
SHA1 8750a73316bbc555c1063bf62fc66e56095629ad
SHA512 e50bb33a226e9a729cce891a7bde77ceb104ea689f8da81f07244e0a96a7702468389c6f815d2090de690f37e09dff93f8c4587dd57c854d9ce8c28108b5c25e
SSDEEP 1536:cAqlzmQsrLGsKdwqaQslel6gnjVdVrZiSL:7tKsM3njVdlZzL
TLSH
T1E2435B53F5D0C572D010CAFC8C46D6E9F93B3A3C2D295492BEBA1FCDD92A386250D19A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3320	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3320	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3320	2896	jaffacakes118_1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1c2028220717ec8a083233e78bc0d0aea4739f37cec81a8b5cb58468b0e5d42f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\Favorites\hfdf.hlp" InstallHook1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hfdf.hlp

Path C:\Users\Admin\Favorites\hfdf.hlp
Size 40KB
SHA256 2832bb3b7976d2206096741ebb3ccfdec37943ce64d1301b34fad66e71058536
MD5 dc7328eb949e2491af1550b7746696f2
SHA1 0561821a8a1cccbfdb2274a321c228c0e2f57f7d
SHA512 6eaac17921b71818dde2b3de1f84b0600fc01805528120d475c986ca04f0465148ba6fbc54fe3017ec320e9b9cb40579a45427def8888c00894a799d1672cf93
SSDEEP 768:HCwqaQpJklel6gnHjRbBVFg6vNL90QwkuYjj5iSL:iwqaQslel6gnjVdVrZiSL
TLSH
T19B134B17F590C571E01089FC8C46E7EAF86F7A3C2C2954937EB91FDDD92A386160D09A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2896-3-0x0000000000400000-0x0000000000416000-memory.dmp

Download