Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 10:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
General
- Target jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe
- Size 90KB
- Sample260924-l58bcasdqa
- SHA256 4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7
- MD5 afae818f84250584959821e00bc5f38c
- SHA1 579823c7e29ddf764b3184e4b15565fcc57bfab0
- SHA512 08a18d7ff06398add8bada32be4ff566e2741055a960ebf35255ff1c18f117ad1924bafafb14a11fa9e8ca21457b64bfd323ed3bfb1924362d00d6ce4a964024
- SSDEEP 768:6YmoxM26xcn0rSIYbax3q8F3zPNCmswcpn6MErFLBxZl8CIyXVNK4q5v1YigZB:RO+0rSpbujPcmIn6M2BZl1DlW1YL
- TLSH T189935B325B5C50F1E606687AB86A3F7F8A2B5120537E2AD71FA33E4098773E0B535346
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe -
resource yara_rule behavioral2/files/0x001800000001c41d-3.dat vmprotect - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ctfmon.exe jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5856 jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4efba83013f2c6c156640fc95bf2239e65bdfd22e66f24dc12466ca77522afb7.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\240722687n02.dll
- Size 70KB
- SHA256 63d80d0da7dc25ea01f22df6236e39c0e2143fdcd5c9883a23497addea154894
- MD5 12b7b4efa35663b03e6d1c492369dceb
- SHA1 90ee4ae96c4d2a4c62d67f1e7b2135be8f1122bb
- SHA512 a1dfe480f0a3aa233943ff383f742b7fe628e822b8726b516b6ee3220bbadd21aa5a41fd159dea55ee74aa278e8ad011c00e4239ec4a75db8d1cdb4c3d88be90
- SSDEEP 768:fxcn0rSIYbax3q8F3zPNCmswcpn6MErFLBxZl8CIyXVNK4q5v1YigZB:f+0rSpbujPcmIn6M2BZl1DlW1YL
- TLSH T1E3636A325B5C50F1E606687AB86A3F6EC52F5110937E2ADB1FA33E4098773E0B57530A
- MD5 SHA1 SHA512 SSDEEP TLSH