d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
Size 66KB
Sample260925-28ljrayflg
SHA256 d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b
MD5 a1c8ede70230871453ca2b610c0e1848
SHA1 c7cdc98daa11b4f5bed55ec51f59045e8467599c
SHA512 c7ffe90110cc5bab15107bca0fcd6ca24891bc45716a573d545e34173833b2d837fcc0c0c937108e4571cca1fcaac8b2f0e1f71f1ecc4440f3070003537e3c33
SSDEEP 768:N+vq0L1szpsnLuhXqg+vx63v+5qD1szHOhbZRTNjT0ENw8gicKYYwg0tYcX86oIX:gvqM1scLUe5qD1sD2TmENwhvgwYc/n
TLSH
T15F634947F9C0CD72D11C49F88E25E999FA2B72346D2990B6BDAE1F8C9C653900C1C69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4872	jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d3e98c0e5e8d445e4d9d518985165142255f65297edcf088307f45a78655bf1b.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 43KB
SHA256 38c53ef04d4616e900bb286db47ff5f5e81f126698f1636e1207909c0a227dce
MD5 dfa766ab2003b38ba4b5343b693462f6
SHA1 1f7a6fd47580dff12ee4bfc69b9e28d7a5b38696
SHA512 0e332a434e5bc9088a6f7622a9358a2fe44f1da8030b7960abba65b619b977ceed33c82218ac4fd8ecbf4021866eda181c6a0c52c9b0971c0d7c9177474cc4c5
SSDEEP 768:9v+5qD1szHOhbZRTNjT0ENw8gicKYYwg0tYcX86oIwL:k5qD1sD2TmENwhvgwYc/s
TLSH
T121133817F9C1DA72D12C0AF8DD26E991F42BB2746D2884B6BDAE1F4C9D653800C1D29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4872-6-0x00000000006E0000-0x00000000006F4000-memory.dmp

Download

memory/4872-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4872-10-0x00000000006E0000-0x00000000006F4000-memory.dmp

Download