122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
Size 58KB
Sample260925-28gwkayfle
SHA256 122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6
MD5 756291546b89f14b043a118976e86a66
SHA1 a920de118da97421e2244ebb66ad240f86eab1ba
SHA512 2607500f993ac200b42ba2e146229a32cca357df117b3f2204ca034578afd250c83ecae1e2da50e5b6902f333f686244be4344e414e1a184da1ef1f27c91a1ff
SSDEEP 768:SueqsOpLszspzOPPkCnnj6qABe+Wqy1szYbuO5k8MEJH6pubkKXohJM+:Zeq9pLsqzMkmAkhqy1sQ5tMm6pkkdJl
TLSH
T172434C57F9D1D872C100DAF94F26C169AF3E36311D7588E9B9A82FCDDC2A390295C18B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_122c99cabd82272ce06b291144c117fe4c35adee8ac358d2729ea67f6f2e65e6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 33KB
SHA256 6a9f00dace424dcdd98002f21f9266b9442cfe905efb07cd7927ee149ed5d890
MD5 bd604418985eb7e977b286fdd1622747
SHA1 7edd6494f49412268b91e5779370b96f8eddd518
SHA512 c87199c903d16d55be040c36ec433fcceb171150a1439f43db7406d20eafb3f5d48b644b74b5fbb289654aed0a3f7dec7fa6f45be2d326a276cd78bf000d7c1d
SSDEEP 384:YAake29TKv3q1awaqLA1szNQTzagNecANO5kD4ME7RzoM6BbUou/cCjso0UC4R3C:YABe+Wqy1szYbuO5k8MEJH6pubkKXo5
TLSH
T1A0E24B53FED1C472C10089F98E1AD169AE3E76311D7588BABDB42FCDDC2A390186D1CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-8-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download

memory/4600-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4600-12-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download