32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe
Size 30KB
Sample260924-eetxpsdd86
SHA256 32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e
MD5 65201e2a428a99b1385041d9ff46367c
SHA1 4d4214a673faa6b29d59488bed98fabe28c7e1fb
SHA512 cf19dcdf020dd24dd37494567c1f1231ebae45ecbbdaee2393cdaf5d98b88e21aeca1257b318906b0de649a9b2a6b614096271eb5e954c61d887741baa57a504
SSDEEP 384:Eqpe77qR//V64TyilsEbywCE9yRRKaJOjmnj:EqpDR/3veAgRKaJQq
TLSH
T1C0E25B2779860533D4C6817274B48716AF7F27231FA599C3DB44A54B3EB09F1AA3E342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3652	ssvchst.exe

Executes dropped EXE 1 IoCs

pid	Process
3652	ssvchst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ssvchst.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 3652	5840	jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Users\Admin\AppData\Local\Temp\ssvchst.exe
  "C:\Users\Admin\AppData\Local\Temp\ssvchst.exe" C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ssvchst.exe

Path C:\Users\Admin\AppData\Local\Temp\ssvchst.exe
Size 30KB
SHA256 32a73885ad121e379e9352880c04a3fa528069527ebfee070948b98ad74a737e
MD5 65201e2a428a99b1385041d9ff46367c
SHA1 4d4214a673faa6b29d59488bed98fabe28c7e1fb
SHA512 cf19dcdf020dd24dd37494567c1f1231ebae45ecbbdaee2393cdaf5d98b88e21aeca1257b318906b0de649a9b2a6b614096271eb5e954c61d887741baa57a504
SSDEEP 384:Eqpe77qR//V64TyilsEbywCE9yRRKaJOjmnj:EqpDR/3veAgRKaJQq
TLSH
T1C0E25B2779860533D4C6817274B48716AF7F27231FA599C3DB44A54B3EB09F1AA3E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download