fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
Size 64KB
Sample260925-263p9aab75
SHA256 fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e
MD5 a5dd8ed10ad6d6ad70a11d442001395a
SHA1 47e6ebacc80153fa0b67f8368e0942a35df0b3ff
SHA512 d6e967e041895a24ce2d6e9a526f091fa2215485e75c139cd6368ced571b7521d60f55dd3d389fa4baf57a7f539076f0117c28f0eac50ea090c85df411c117e9
SSDEEP 1536:teq9pLsqAoRB5WqH1sJOT2G6YJNCNmIBkV8Ri:RVgM16O7DIBkSk
TLSH
T190534A57F9C1D8B2D12C8AF8CE15D9A8F52B32306D1590F6BDEA1F8C9CA52940D1C1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fcaf484e370921ed20b13a45c2ce1bfc4b63d5d0453d4fb403a7ee29f300602e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 44KB
SHA256 ab80830989be2e0a47e4a4eb322b89488a0b8eb4df965475c0f650db88576bda
MD5 ade42d586d8039b16f5c503ea16b9692
SHA1 aa95322455d5164451e14467b17625ea4b52d418
SHA512 1145dfacce871c4302790621ca1f3f8cfd6ca861071b7f8d9c719822fe6052bf503067359a8820d24266d24e86f37fe0a5832b5b0ad080536d08d1a8cde74cea
SSDEEP 768:Av+WqH1sztWgzMFb4L6SK2GVIvb5YHwK+w5gvHtuK6x3NbwBr1NQV8q0yI:ZWqH1sJOT2G6YJNCNmIBkV8R9
TLSH
T189133913FAC5D572D12C09F8CD15DD98F42B73356D2880F6BEAA1F4C99A62940C2D2AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-6-0x00000000006E0000-0x00000000006F4000-memory.dmp

Download

memory/1748-9-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/1748-10-0x00000000006E0000-0x00000000006F4000-memory.dmp

Download