d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
Size 64KB
Sample260925-26ch3ayeqe
SHA256 d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045
MD5 d393c002ea1036b98b85839c18f46628
SHA1 7c1bf2b70cb0f0972f0c067bdb1efdecf4a030e8
SHA512 6a1199da1d88a4d36b56464b23a00839ed12314cc76bc8ff2aa6e6169cb48d606dee7f5df0aa81f176535a1e612d4156fc6ca9136dc6bb0462e1dad880fd6699
SSDEEP 768:Nu/q8XpLszJJVpwOGqkF7aVsz9GczcFb4po+EuCk3W1Rh1JiOshVKiUc+I8vYZ:w/q8pLszGqO7aVsZiIn9YBZJvO
TLSH
T159535B67BDC2C8B1D0284EF88E26E166B52F37305D5590FAFD9A5F4C9C692980D0C68F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2392	jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d6d021d07e6026eef42b6132d483552daa83d6662b701e1f963d454d6012c045.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 45KB
SHA256 faa0b362a4ea74adbf68eee49cf8f604eb484852c5d439cc541fdf6428076d02
MD5 12ae1419d0ebe57a1a521f702be4200a
SHA1 80aa249ce7a6815497a81b234d0cfe4ff062e7a6
SHA512 7d56975c6a8bec2aee89e3ccf9ee6df55b6e053b861c63106324fab65fc89c747a43bec4761279edf199733ff662049cd1c45afc03317caa11e42cfb67353424
SSDEEP 768:/OGqkF7aVsz9GczcFb4po+EuCk3W1Rh1JiOshVKiUc+I8vYi:GGqO7aVsZiIn9YBZJv9
TLSH
T1C6233927BD8689B1D02C0DF88D26A156742F77305D6990FAFD8A5F0C6D7A2880D1DB8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2392-6-0x0000000000570000-0x0000000000585000-memory.dmp

Download

memory/2392-9-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2392-10-0x0000000000570000-0x0000000000585000-memory.dmp

Download