6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe
Size 232KB
Sample260924-kvbzqaaa34
SHA256 6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a
MD5 532e810d6ee3238cb8d66a3085d91edc
SHA1 dd4b9573773fc8bc0ce20db631285bf80562e1c2
SHA512 1276da7309b9fb079500af0a3cab8a914757dd5bc545c40b904255350eb9bf28ceb507d78f8059b0873874266661baaed1d3d4018fb314fe3daaad33f367a1d0
SSDEEP 3072:vWm0y9bHsFeSWv0jr2lmO+Hx+Nt+11YuxtMJtzRiwJxBD4EHLFbxckrC3fAbQWfL:vR0kbHgFDxMr7psHSh4Htt
TLSH
T1FD34C62FB281D67AD72681B26E6693B411DDB83241049407FBD35F2A37F59E6873038B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4716 set thread context of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90
PID 4716 wrote to memory of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90
PID 4716 wrote to memory of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90
PID 4716 wrote to memory of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90
PID 4716 wrote to memory of 1840	4716	jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6730e8b18b488d0cc39a53088611edc19d6e14038b4c17b49041e83393e4a74a.exe"
  2⤵
  PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1840-3-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4716-0-0x0000000000400000-0x000000000043E000-memory.dmp