1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe
Size 16KB
Sample260924-ec8m3sydkd
SHA256 1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9
MD5 07fcfc0fa42d27ecc53838735dc080fc
SHA1 16527642c9bac17bcf42fdfb30c9188eccc9d7a0
SHA512 500e9a171953e6588a4e9d2bb586fb8e26f42261cdbe5123d56b5b37e32b1ec51cfd1686d388a1d428cd68f5fb8d7a7c829dc8abcb0df5e19cda396fca44e573
SSDEEP 384:cpy2GT6UerSJbTYeSLSfhNmPOqqmIb+31SHt1vbNg:cpy4ryCeZN3qNIa31SHt1vbN
TLSH
T17D728246079D8BB9D085497CEB15BE7342A6AC321ACF74B7F740B00679B88E6A131F53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1380	jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe
1380	jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
1380	jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1de0a71f84d432026a6455e34cd076e2fa7f92ed00890d9a0d2ce0ad01c5cbf9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads