c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
Size 80KB
Sample260925-167tjayv8r
SHA256 c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1
MD5 6740f939ef5250b1209c02532cf5d209
SHA1 75d8fc5669fab81a1c7485bd41005312a95fc6ed
SHA512 4cfffd5af44384f2db128b4e93bd7cc5b54524b3cb4788b7582fa67c358cbcb3dbd61f1d98c552a7470b55b37aebbfbdbee2995a23002b6bf6468e9551da52d0
SSDEEP 1536:jbbUgdmbdbTS2elqtyrk4zCAXYB3xJrZkvVVIOBbbhiq:j1dm5u8oAnfBhJZkvVFbh
TLSH
T19C838C8B379545F2C4D7067062563A399ABB5C34196ABCA7EF10B5C23CB10E6E139F83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2132	rundll32.exe
5928	rundll32.exe
2132	rundll32.exe
2132	rundll32.exe
5280	rundll32.exe
5280	rundll32.exe
5280	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\whh30010.ocx	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
File opened for modification	C:\Program Files\Common Files\whh30010.ocx	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
File created	C:\Program Files\Common Files\0E59520Ece.dll	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
File opened for modification	C:\Program Files\Common Files\0E59520Ece.dll	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5928	rundll32.exe
5928	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
5280	rundll32.exe
812	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	5280	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 2132	4176	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe	90
PID 4176 wrote to memory of 5280	4176	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe	91
PID 4176 wrote to memory of 5928	4176	jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E59520Ece.dll" m3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:5280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh30010.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c14a4cb821b8687cd450efe0a44c7475bc2f52f59b4a7db8c0182288f7c1eca1.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E59520Ece.dll

Path C:\Program Files\Common Files\0E59520Ece.dll
Size 10KB
SHA256 f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13
MD5 f1f49fb85ab029ad86c02ebecb892b12
SHA1 664a602f8e843218c1158571714cd0adee1da939
SHA512 600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673
SSDEEP 192:cjbjEyfon/ZtXNfKpF+vXXxbI/86uyvdo:H+on/ZLIsfhbIl
TLSH
T12022B49B26910663C9950F7412AA3A3D8C2B54F8435F7977EF50D8813CA60D9F63EE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whh30010.ocx

Path C:\Program Files\Common Files\whh30010.ocx
Size 50KB
SHA256 a27eadd13fb71f9aebae0f9ae02769f9688f5a7f19e22cad080243757de18dfa
MD5 51de9c8df2db5bbe56c4cf08bfabe3de
SHA1 12653addf1026cf1a4ae4791ea337d85dc5c0557
SHA512 d5d43e26ca473a50aed7fd225ac39cb30a0ae790e491b2f5840f75ee354bfca88541193694e94f228e5d0ae5c15049278889430d6e2ce206d3acf026f92fb5c3
SSDEEP 1536:fdbTS2elqtyrk4zCAXYB3xJrZkvVVIOBbbhiq:1u8oAnfBhJZkvVFbh
TLSH
T19433AE47376558F2C8DB457061163A29AABF1C341D64ECB7EF20B1D2B8B10E6E036F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whhfd008.ocx

Path C:\Windows\SysWOW64\whhfd008.ocx
Size 14KB
SHA256 672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b
MD5 731659d09654891912ac223e20cd10ab
SHA1 13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071
SHA512 e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116
SSDEEP 192:59Fij7/vSyR07lego8slUOD9kkmZAJ5ihHbr:5rijzvVR0NElUODhdm
TLSH
T1FA52E9CDA7CA8252D1A3467026983A3752BBA4B44C3F226BE75459C53CB84E7E735F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2132-15-0x0000000002440000-0x0000000002651000-memory.dmp

Download

memory/2132-23-0x0000000010000000-0x0000000010208000-memory.dmp

Download

memory/2132-20-0x0000000002440000-0x0000000002651000-memory.dmp

Download

memory/4176-0-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/4176-10-0x0000000000400000-0x0000000000618000-memory.dmp

Download

memory/5280-19-0x0000000002C20000-0x0000000002E31000-memory.dmp

Download

memory/5280-22-0x0000000002C20000-0x0000000002E31000-memory.dmp

Download

memory/5928-21-0x0000000010000000-0x0000000010211000-memory.dmp

Download