ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
Size 50KB
Sample260924-ma3m2sbb52
SHA256 ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae
MD5 eed0ad031d471b292473362da752f645
SHA1 2d98258178b534ffea2db882b815a277113ce7ff
SHA512 3b834b69a0f89e8ff7a9fcc8a99ab6807213f0474a9fafade72b2cc0719b19b8c594cda28f19f0c684744374d4ab78cfc4216e5a5538ca5716ae4a2b5b7b09e2
SSDEEP 768:O3P5S6PA1ToYxoDDBr3KbjvdjeUQ71d9OI:IS64yYiDDAjvdjmd9OI
TLSH
T13733FA32BA8A51F5D29E1935347ABBBF862F683152A471D35F63EDE14877321E028307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1212	jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ad1f8f208ffc7644534bf3394d1d0a01be45d53b83071cfd9847c2aae33e65ae.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240776890n14.dll

Path C:\Users\Admin\AppData\Local\Temp\240776890n14.dll
Size 33KB
SHA256 2aecf88b362cc29c778159e5795cd487e5ad993cd496d915e853d8bc09bb7085
MD5 e696759c09228897f637f0257fbe7817
SHA1 c66fb71d21b40fcf3ff24cbdd1ea4269ad134c12
SHA512 b9556654a0b399ae90e22cc98d810e2bd7144c95019589f617c7cc444a313d898047d5dc98e8628c913443623f89ed7838cfcd70bb3818ecce037a2c99302981
SSDEEP 768:N5S6PA1ToYxoDDBr3KbjvdjeUQ71d9OdI:7S64yYiDDAjvdjmd9OdI
TLSH
T181F2C531AA8A61E5D25E2935387ABFBF862F693155A471825F53EEF10837331F028307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download