2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
Size 59KB
Sample260925-28ndcayfma
SHA256 2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97
MD5 dc7eefb8889094036ff1280ef94c8abb
SHA1 119c7cb7be76a6019800a40b400b2395c1427176
SHA512 559417153a8e6251710fc724ff484a8690cd1d1105405e09340172491e73b71b777231041e061f69e2ae65d5dbd2b07a75d46b4f31a75bfe6c678ad32f997b90
SSDEEP 1536:7eq9pLsqze0hjPhqy1sUB0zeKdnRqCiub:XVj9hb1dB0fb
TLSH
T18F536D53F9E0E872D044CAF84E25D12DBB3F76311D6544EA7DAA2FCDEC6A280196C187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4844	jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2e61e848383be65c93e59873c66265f7b383d1440e55e68a64b53b07a8944d97.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 33KB
SHA256 617adad74a7da4b02b8c632f6504024610447e9a783d159cfba09c4997b46d06
MD5 4373cbd73f112b25fb640cff91f36107
SHA1 27633866c10310d69338ecd9bcacd5b5aee898ac
SHA512 e6048443b30b6a615ce850f59be475c920239a005860f94d9a7d18a45682ee50b423e1f72e2837f8327097cd9d3bdfe01bf31e711a482175aeea400bcc126f24
SSDEEP 768:X0e+Wqy1sz0buOCY1n0zKbKdkGRnQPCOZtNOaT:XPhqy1sUB0zeKdnRqCiuC
TLSH
T132F25B13F9E0E471D14485F88E25E12DB93F76311D6898B73DA62FCCEC7A3840DA918A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4844-8-0x0000000000580000-0x000000000058E000-memory.dmp

Download

memory/4844-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4844-12-0x0000000000580000-0x000000000058E000-memory.dmp

Download