ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
Size 134KB
Sample260924-mp3xcsbe83
SHA256 ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e
MD5 ff14e2714b3f3a6073c5eade15ab40d4
SHA1 4e9dfe7bcff7c3431cb1a09a70c7de1418a2fc86
SHA512 09d887b759679af8893eea03e98a524811a6cceea1078c58daaba845105d66a20f4d7acdcb4c5349870b7daca3419eaa84989f536a46fc2276191d4e98502c9b
SSDEEP 1536:EnRMfP2DpnDv2fhnqxQclXYPc0VS9hKctchkNTwu5QEFDkMarzAN:EnRuP2tv2VElX3x9Y9ETwOFkM8zAN
TLSH
T1EDD37B26FB8145B2E0600A7D9E1397A5952B77302E36245B76E44FCD9D3C2C39E2E363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\kernel.dll	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
File created	C:\Windows\svchost.exe	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
File opened for modification	C:\Windows\svchost.exe	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
File opened for modification	C:\Windows\kernel.dll	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
2340	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5276	2340	jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5276
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea728710663e65655c1572e0ffe41198323dc872366ea6a3a99192a0b63ea17e.exe"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2340-1-0x0000000000400000-0x0000000000427000-memory.dmp

Download