262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
Size 60KB
Sample260925-25ayvayepa
SHA256 262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149
MD5 21edbe990a3dd59606bbbbe79e87077f
SHA1 8cace6907a0c298959ffadd3b10dbae8485bebbb
SHA512 9d0ed8d77800f2be0cb31661af9b0be56a658234d35ab3885a749a7a7b945b63e0ab68378f93e0ce945ae86e634b7ff2691272e3a1c9cb0bcea7981c5b4f2f5b
SSDEEP 768:Du/q8XpLszhAaEquDMXdrpEv+WqH1sztWgzMFb4TMNv2xYEpyy7fLgnJsS22wZmY:6/q8pLsWenWqH1sJORK3fngnJs/ZV
TLSH
T19A535B57FC80D9B1D02C8AFC9E28D598F93B36706D5541B6BEAE1E8C9C693A40C1C19F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2400	jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_262e7c8f8bed77905f042d1b3d2d7f7d9d2550fba4a7d7ddabb5d568f2e67149.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dll

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dll
Size 41KB
SHA256 0710e02dc90896e71091101670c020aa6f0a792a19ef044e9d36e4f4c1153b8e
MD5 456b82b1c0572654b17c05fedafe70cd
SHA1 d96d487dd2e392e405abf41163f9d8dd11e78613
SHA512 96637c040d7f00879ba8d845ad4c76ea911a110d84a02a419269e8be066787cf4586ab89ac6794453470307048e7f22eefcb0482f39e76924c23954732055b92
SSDEEP 768:rv+WqH1sztWgzMFb4TMNv2xYEpyy7fLgnJsS22wZmYw:yWqH1sJORK3fngnJs/Zy
TLSH
T18C135B23BC80DA71D01C0AFC9D68E594F82F3275AC5990B7BEAE1F4D9C652A40C1D69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-5-0x00000000023C0000-0x00000000023D4000-memory.dmp

Download

memory/2400-8-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2400-9-0x00000000023C0000-0x00000000023D4000-memory.dmp

Download