abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
Size 64KB
Sample260925-26skaayerc
SHA256 abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330
MD5 0638ddb44829cb95b527eaa0c1338f8b
SHA1 ca21bd7235fa9b58e993c91f23f529fca84709ea
SHA512 9a1d683c0cdd2a9c73abd69c530e074eb5f391df0e39d7e4b34b1df79af407791c16fe5a4b7daf652f8e1aef78df42fa31b5e7938b50821d40602cba63e3e3a4
SSDEEP 768:xu/q8XpLszJJNRpYOGqkF7aVsz9GczcFb4p2SvZiOeTTr/DJROAPsGP4tcDhzmec:k/q8pLsNGqO7aVsZiIHcO7YsK4mFc
TLSH
T13B534A27F98198B2D0388DFC9E26D159B52F37305D1580FABD9A1F4CAC6A2980D1C68F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3268	jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_abfb364db21c5ec0371a7840e8fc314b580549682f1ca688091762bfb2d88330.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 45KB
SHA256 13f9a22a458fe965eab515337723ec3931efb6ff14fa6c9e24721dfef8ae3e82
MD5 5482cfdd2132a87c26a351a602108bbb
SHA1 6f7c51ff24c42ec041ddb25b6392ab34e8330cd9
SHA512 57c301eda367e32b3466572ea01d7bb542041a759c3043df061cc6e9db22c719109715e22324f88a35910db53e65f838279434de40c34fc2779678469539d447
SSDEEP 768:zOGqkF7aVsz9GczcFb4p2SvZiOeTTr/DJROAPsGP4tcDhzmeH57l:KGqO7aVsZiIHcO7YsK4mFj
TLSH
T13E233927FD8194B2D43C09FC9D26A145B46F77305D6894FABE8A0F0CAD762880D1DA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3268-6-0x00000000006E0000-0x00000000006F5000-memory.dmp

Download

memory/3268-9-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3268-10-0x00000000006E0000-0x00000000006F5000-memory.dmp

Download