1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
Size 51KB
Sample260924-fn2vcaed74
SHA256 1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9
MD5 6bb2cbf8def7a7cd3d7c957ca96d4ebd
SHA1 a07efac0e69edb50044c57eea45c69181b83822d
SHA512 a4d6f4d7a7942872954d30c6f80001937014067f0f4985ddf4cc872cb2f73104617092081690c13eb5fa4ccc72fbf7fa7a023811fce3a63c25b1915673fd4638
SSDEEP 768:JC38C8jWhgI8Ip6bherFNM8JXbV5N0/R0HIVVq/ksXnZteba1dDhShZ:JCh8kHp+2NnXbVboVwkWZs+bgZ
TLSH
T1DC333A46F9D2C4B1D021CAFD9D16C16FFB2F36641E6810C9F9EA1EC8DC5E246252C68B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1020	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
1020	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\Explo2eMt.456	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
File created	C:\Program Files\Internet Explorer\FxplorePe.New	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
File created	C:\Program Files\Internet Explorer\FxplorePe.New	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1020	1228	jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1d654889e3589ac2e6ed25e1865a6fc7dac379c4b7ec013186c9afa9bb54dde9.exe" C
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:1020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explo2eMt.456

Path C:\Program Files\Internet Explorer\Explo2eMt.456
Size 30KB
SHA256 5a52b69276f1725ad99fd3e430d776b4ad6a07c4aca8737d3431f2ee3aa1e497
MD5 213ef52928ffab1a464bf2ae403e7eba
SHA1 5b1350ae6c5467fd0167a9d1fc0bec355b3401d1
SHA512 f75f8ff637f687f355b1c2672b89dc6f277318f0b0a12553d2a0d59a7a8a6cc220822ce3f67dac5d3eb3359386685b1afab78f2d07217a563a645395fb32755b
SSDEEP 768:IM8JXbV5N0/R0HIVVq/ksXnZteba1dDhSh4:InXbVboVwkWZs+bg4
TLSH
T11AD24B46F9C1C4B1D020C5FD9D26D15FBB2F36685E6C14D5B9EA1ECCDC9E2420A2CA8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FxplorePe.New

Path C:\Program Files\Internet Explorer\FxplorePe.New
Size 51KB
SHA256 e88b4eada9dae26c61e01373bde992474412e57adea7200ebad4ca36c3247f83
MD5 8fd73d41ca3584d765d01263bb66032e
SHA1 dfb1a7b55503b7dcf14d77ef3a80cdc5f7bd1c0f
SHA512 a8bf785b8b117e45aefa3abaca6a9c2742b34a75268c098bf11c9d3706673779560c38450490eaba02b73f54bb1490a67e65d92f6593e2365bb4821c514811ab
SSDEEP 768:mC38C8jWhgI8Ip6bherFNM8JXbV5N0/R0HIVVq/ksXnZteba1dDhShZ:mCh8kHp+2NnXbVboVwkWZs+bgZ
TLSH
T1DC333A46F9D2C4B1D021CAFD9D16C16FFB2F36641E6810C9F9EA1EC8DC5E246252C68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1020-8-0x0000000000700000-0x000000000070D000-memory.dmp

Download

memory/1020-10-0x0000000000700000-0x000000000070D000-memory.dmp

Download

memory/1020-9-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1020-12-0x0000000000700000-0x000000000070D000-memory.dmp

Download

memory/1228-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads