0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
Size 66KB
Sample260925-27ckfsab79
SHA256 0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444
MD5 305a636f28e02b5aa7c5d11591e9aee6
SHA1 a753f597ef7ccf42a64c634c7c0b51357e215bc0
SHA512 dc9ebea3017f3016a1d3fc9e8f13a5e41b49d4b00cc7015f19bee459e9b8bf4a66bd0f52619fcacd3212327dacbe52c50a1012c435a34fcf374482aa9cf0d7b9
SSDEEP 1536:UvqM1s3mK5qD1sD2TUPuwmjvD+fdtkx0ld:01om71E2TUPVmv+dy0r
TLSH
T175634947F8C5D972D11C4DF89D29D998FA2B32746D2980B6BDAA1F8C8C663900C1C69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3564	jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0708f04497c860122a93b5885e6bb885f74707baf36ae5e2d4d40c482f07a444.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 43KB
SHA256 92231f29b58f8533f9aada7b048b10b037f4d6d8c4920ae09dbfe6efdd8c83e1
MD5 b87955d39b613c655c99eddfaef6d596
SHA1 9b90dd94f5725624e8452f02040c194fc7965827
SHA512 7e47e5f393f207fff5b7dae83d853c7524ff0fe7271f00f9fe44fb58a9c7c7aff7c4c833f775d38d2d287fb804a9f7fc1d748626e04f7fe98125ccde861ec7b7
SSDEEP 768:pv+5qD1szHOhbZRTNjS2EuwmllyC/nrR3drOf/0wFXke8her1rlg:45qD1sD2TUPuwmjvD+fdtkx0lS
TLSH
T12B133913B9C1DA72D11C0EF8DD2AD894F42B7275AD2980F6BDAA1F0D9C663904C1D29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3564-6-0x00000000023C0000-0x00000000023D4000-memory.dmp

Download

memory/3564-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3564-10-0x00000000023C0000-0x00000000023D4000-memory.dmp

Download