11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Size 40KB
Sample260924-ktlsjaaa23
SHA256 11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec
MD5 ae0d396911e3b42331fe1690f4995565
SHA1 54a741816f6f40f23e02073f887762d23f8b1e51
SHA512 97b14e8999e9a6a34c8f695d5e5a9a4208c07c29a665f306c9a3cb4eb2b377f3c043b150a3799322888ccf5b95dfbf6251216f3114ef4fa08d2af88d7fae8e2f
SSDEEP 768:/Z5/3sNAzbt0vDzvCBtrO8/2c1w5Uvh5uY:/v/3sGzbmvfv2rO8/2c1w5Uv/uY
TLSH
T1A003C85366183421F1614B754DBA63E5662B2D304A00DE0FBA5BFE1C2A319C3A9F672F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe"	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1148	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
1148	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
1148	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
5848	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
5848	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
5848	jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1148

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_11102f7cd6c81dba51b335a5d27f64bdd681354e03b9d4632623ee7ac81225ec.exe
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1148-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads