Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe
- Size 136KB
- Sample260924-mgr5wsbc77
- SHA256 e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f
- MD5 2a891d7f605c913dabc25192c6e93082
- SHA1 f69afcedeed4c1a8fafa79e4fcd1fe91e12cb8d5
- SHA512 f526001aa337d1291bf593ec1646ad631dd50fb86572ba011c98bdcd707b2cb229c24b2742b08af3a11b22696b34c07984e8ba5232ffc260d3bd79a321e9a35b
- SSDEEP 3072:W5Jb3dp7yX0YIFpjJKEZ1TfBz935+AdnhAv4r63SZ2Fey:Md3dp7qjIK+4a6C
- TLSH T1CFD36D67F2C0C4B1D1A01A7CCC09E2E5EA6EB9701D29256BB6DC0F8C9F792C2195D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\xwdll.dll jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svhost32.exe jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe 1132 jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e3c8e40e64a4b8fe19ec61866c3ff4863e763596eff4607504fb7e9d02947c2f.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\xwdll.dll
- Size 104KB
- SHA256 9b81d6cf42948673e550e26814182c80fcc25502d121548476c2eff157f77ed3
- MD5 0c28e32bb7d3cdf097d8fd4d476d266c
- SHA1 32fa25f7d3d214982bbe6a769eac90f519772904
- SHA512 452e93f77ae799b4cf4e392ded57f46947960b93b64c857138b95e06c84e20be5b75728798199236bc6ce05d5d055260fd75b3ce2f0d500f48b9a6acee9f45be
- SSDEEP 3072:ayX0YIFpjJKEZ1TfBz935+AdnhAv4r63SZ2Fey:aqjIK+4a6C
- TLSH T151A35C67F2C0D8B1D2B51978CC49E2E1E96EB9701D2A256BB6DC0F4C8F792C2185D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH