57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904.exe
Size 49KB
Sample260924-dkcpyace93
SHA256 57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904
MD5 ac16f4e4c27071cb2a8fb8f88ef2a4af
SHA1 dfbe674a1940d05a7d59694969204bf99debc61c
SHA512 82aa67f79957d674fb967c023121b59e29a1b3516e914af6f5671b7920199c69902490416d106fe57a92f80eb0018e5ac06c14d81ee2384e24bf0d74f37ad185
SSDEEP 768:1CpqFQAwioKZE0/3T6Ec89qc/dul68YOztMR964wuJKI8x:kpqFQjWb/3Tyc/o2TJKJx
TLSH
T13F333A53EAE18032E860CBB40C38A201A77B3C767DB5597867B539DD4CB4383196977B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rtsm.scr	jaffacakes118_57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_57614ba5f8a265a8da269260ebd3c71d44015ee9fa842be76d2c23d7e9a81904.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rtsm.scr

Path C:\Windows\SysWOW64\rtsm.scr
Size 186B
SHA256 ed0c11884bf8d6680a7b9d9f96795df47aeaec1390d1d27acc228f80199aa72a
MD5 ddd7b9de2762817229b19dcca8e0c7ee
SHA1 709f7e1d87760ac2fd5423af466ddfc04090f1bd
SHA512 80af0d507dcf9daed8bf0e967618a5fc4b5541076527f8b3af458b480bbeb060ffb6d2fc6c54eac1c2aab7e18192b8a00b8b4e9ae3dfc8cb809bcac1b25d86ec
TLSH
T176C012DA1F009C96597396C098F552045D3622857082961243C5997295DCACC28421A4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2844-7-0x0000000000400000-0x0000000000413000-memory.dmp

Download