a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
Size 56KB
Sample260924-ma148abb49
SHA256 a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00
MD5 d482c91ed9c11024a9a8c9fbc4149a30
SHA1 1dd2913f4b94e4c5d297306836e7150768ec3465
SHA512 bc932948a5f369e48da98b20ce4ab7cddcb9556d38192532cd3ff93a633f2fc1ba445aba2b32c94ee7b136c8baafaa2b4e6e4047b785e14d843f8d61bd03e204
SSDEEP 768:8HcPhKgk36QQBiIEQaMx+HVeEzoswdmPzhARXhicTc1vj5TUMuD:1Md36Q57/Mx+HMEHrhARXUbvjNUMC
TLSH
T140437C366EC990F2E74E1975385C6BBFDA2BA530666468E35B73ECF4583B311E018342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ctfmon.exe	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4024	jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a8f41f4deb89ac50b1b21576b87713a3381877ef9c84d7c3b2aae8603ef26e00.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59a5fan01.dll

Path C:\Users\Admin\AppData\Local\Temp\e59a5fan01.dll
Size 28KB
SHA256 4f6239db558a9f5d5b9ecc26fe42266fa4b7a2e0b5ad65917ef4fd5736af096e
MD5 865cb8eddc3a2e1b961c3f97779d5d08
SHA1 1b3f27b3c090947c53602f664724b4ad762e919d
SHA512 4b80dbdcbf8c2e9597f4963bad5256dd46e15dc7d856f028c5b7f723d852d00f294da2e62b96929ecdfe366a29d11e70861e39cd5ac4ccd710641daea9ff371f
SSDEEP 768:bgk36QQBiIEQaMx+HVeEzoswdmP9TUMuD:bd36Q57/Mx+HMEHpUMC
TLSH
T144D23A01AAC990F7E34E1975381CBBBFDA6D6530A1B4ADE35B63EDF4082B221F125345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download