59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
Size 56KB
Sample260925-2873rayfmg
SHA256 59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42
MD5 716b29073016fddc8862ea1ed52f214c
SHA1 dc8ea52c8da9d8c11547709cfe75a0551fd6e111
SHA512 70dfb183278685893734e6842dc2b77271027eb3a66c8cb616280f370b0c58cd4aef7b15c24943e22dc0009721a3de87308b556422b68d38f6d66cc9359da025
SSDEEP 768:Cu/q8XpLszxvzWEWiBxc8Be+Wqy1szYbuO5kAMoQfG2OOiFI6DXfjV+Fbf7:J/q8pLspCSkhqy1sQ55YfGpdFLEf
TLSH
T171434C57F9D1D472D010CAF88E25C179AF3F76311D7588BAB9AA2FCCD829391582C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1156	jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59c6e99bf677e896dfd562872f1cb36c258f03f91716f4ce305d8b9a52480e42.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 33KB
SHA256 d722e12e77634e1b1f03aa6085b451bf11047d5d5f25cec97f8c33edebaecac3
MD5 c0c6f1c97c8b6256ebe2623b98987960
SHA1 e0ec7309ab5376673ce1547388c8c28afe058f19
SHA512 642c02737c909d2046c2708b805b0eedfca2f9d23fcfc95d2142595aad87580d4f81f57354bdd0bbf7d81b97b05e6f239b4f1311d7ff4464c3b4623f5359fb5a
SSDEEP 768:hBe+Wqy1szYbuO5kAMoQfG2OOiFI6DXfjV+Z:hkhqy1sQ55YfGpdFLe
TLSH
T167E24A57FDD1C432D10089F88E15C179BB3E76312C7589BABAA52FCDE82A39058691CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-9-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/1156-12-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1156-13-0x0000000000560000-0x000000000056E000-memory.dmp

Download