bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
Size 66KB
Sample260925-28r2jayfmb
SHA256 bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400
MD5 bb68cd6f8b1f580a49c9952df7fa76f1
SHA1 f6fbd721ffe0d894b17f8f16e9c15dbed8941c40
SHA512 81657ea8aa663febe2ff7a6b10b4e102e3da850595f279b6ef40c389afda60b82eeb7c00028b63e82a4d1d3fb55780ffb084c899448b3736c16d1c1148d0428e
SSDEEP 768:N+vq0L1szpsnLuhXqg+vx63v+5qD1szHOhbZRTNjT0ENw8gicKYYwg0tYcX86oIo:gvqM1scLUe5qD1sD2TmENwhvgwYc/Y
TLSH
T15F635947F9C0CDB2D11C49F88D25E999FA2B72746D2980B6BDAE1F8C9C653900C1C69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bb373e2717bf10ed5296718b360e2073f1cb050ebf4411afddd0be3f35b6b400.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 43KB
SHA256 60ce1c22a90065cc7a2c9961785b2cb5cc307712b63292e651a6f7ecea014d7d
MD5 66a58122d2a2d530b68f9a15b89728a0
SHA1 9001625460f515134d821c9028122435c2adf04b
SHA512 4b1caada89eee73cb05ed24f91489017f9cbb7bafca708c152a56c4fb4e213bd9ff96df01b948980564eb2138e88033b4c04cbb12b48d4d9a3ff222a5e9c5367
SSDEEP 768:9v+5qD1szHOhbZRTNjT0ENw8gicKYYwg0tYcX86oIw0:k5qD1sD2TmENwhvgwYc//
TLSH
T158134917F9C1D972E12C0AF8DD26E995F42BB2746D2884B6BDAE1F0C9C653800C1D29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4504-6-0x00000000009E0000-0x00000000009F4000-memory.dmp

Download

memory/4504-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4504-10-0x00000000009E0000-0x00000000009F4000-memory.dmp

Download