52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
Size 60KB
Sample260925-25k4taab72
SHA256 52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7
MD5 0541db78c8a71c6d02f1f2e47b253c1f
SHA1 c786117c5c6074eb86b275a861f7997fb8ce91c2
SHA512 d21bdf71e1b326da7a929240c2e7dcbf8ae43a3991e92d025e037bd1f59b33a708f9ec86b584cbf54c1b9acf5959d94cf2f04cdbb7182e64d1e108f62aa534f2
SSDEEP 768:gu/q8XpLszhAqhmoaKlxSv+WqH1sztW2zMFb4T8G0DJZHmlJmuBhwpn/QcSvg:L/q8pLsWinWqH1sJE9dVZHmlCnocv
TLSH
T1BA534A17BDC1D871C01C8AFCDE25D699F93B36706D5940B6BAAE1F8C8C693940D1C2AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_52adb29c6738eba15ce5dc67b3b303d0c9a61b7ca4a8042f30c5901d030629c7.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dll

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dll
Size 41KB
SHA256 08e95ac6e2ac43cd7ba73d2c01ac2bdbd4205fa7733d31e160021a902ab73538
MD5 06dedfe0a2e2d83d9b4a8a3b230322cc
SHA1 a1e86285e0d5aa9635944d66a65a1c3f5e48f3f4
SHA512 6628e37f9617d51e52878dcb0071b262c6143b957fb133a12a5dc2f00fd465546f026dee9db32a677f123f696044c53fda9de72289d6ffdc4cbd38b697bdcfa9
SSDEEP 768:uv+WqH1sztW2zMFb4T8G0DJZHmlJmuBhwpn/QcSvX:XWqH1sJE9dVZHmlCnocw
TLSH
T136134B17BDC0D971D01C0AFCDD25EA95F82F32716D5990B7BAAE0F0C5C292940D1D6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-5-0x00000000022A0000-0x00000000022B4000-memory.dmp

Download

memory/2800-8-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2800-9-0x00000000022A0000-0x00000000022B4000-memory.dmp

Download