7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
Size 66KB
Sample260925-28bpjs1ya1
SHA256 7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda
MD5 50bf4b460f63713ec6eba12c2dec9fe4
SHA1 d6d255d7342a31d382ceba6057fce2e99f56ed3f
SHA512 0b191833bef96174d40fc4e0a93b3c38add86904d4a6a21a9363669cce46884e770eb638bfe715b8822defe13419a3ee3275973e178a36765a278347f360fa45
SSDEEP 768:N+vq0L1szpsba7+/Gr6Xv+5qD1szHOhbZRTNjFLwfkIy9rJabCuTF9MJRh8KQtND:gvqM1sR95qD1sD2T7XIgYfMJRdQr
TLSH
T172634847F9C0D971D11C0EF8CD19E999F92B32746C2981B6BDAA1F8C9CA63900C1C69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4284	jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7955ad1f0d7feee9fc5d31cf9c004c9c5657cc9a2f76d5d4060158c973707cda.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 43KB
SHA256 421fd88ce2d968a5dfecbbf47860b4427a2b5aa28ff8b9b9f0d05a772aef1ccd
MD5 32c31c70600093df5b72e8b387f3a291
SHA1 17a217c54d40a1d293ef40464cc03dc5c4759aed
SHA512 ec363050c83aa6147defe5a2a9cf7d15fe8b5ce1cc09ce8e32911f5684b414a812a1646f7d8aca148ca443206b4cb02bf9cdb3de4116fa0b28653cbc012c5c54
SSDEEP 768:Vv+5qD1szHOhbZRTNjFLwfkIy9rJabCuTF9MJRh8KQtNU:s5qD1sD2T7XIgYfMJRdQ8
TLSH
T13E133713B9C0EA72D12C0EFCDD15E995F42B7275AC2884B6BDAA0F4C9C663900C1D69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-6-0x00000000008E0000-0x00000000008F4000-memory.dmp

Download

memory/4284-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4284-10-0x00000000008E0000-0x00000000008F4000-memory.dmp

Download