5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
Size 56KB
Sample260925-28tkcsyfmc
SHA256 5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945
MD5 1d7865405090aa8ad3fd84276239a6df
SHA1 c269e337ca72450e00c9f9b1a75ba00b813b38df
SHA512 b766824f9797af466aa365a07578f4d1f4ecd80b353999c08941c8665cb3147aeb4bf1fdd992a1a020fcb0b3d799c28598471c4c63c04a0238d98ff8eddf3a6a
SSDEEP 1536:B/q8pLspT/Akhqy1sQ5ix7tTgQESprTpIl:NVoTl1B5iJFwl
TLSH
T13B435C53FDD1D872D100CEF88E25C169AF3F76311D6548BABDA92ECCDC69390586C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4596	jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5c94ec81e3c7c21fb8ada1e002b54e82c0af09c8f29a80f9eeed3feb3e3b5945.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 33KB
SHA256 5ecf9f70aa0060175f28917136b5f145a0b1af6bf6b7acff44626f7bf939de51
MD5 e889f989f58094711233e77fb58dccce
SHA1 ddf1716487d990b319cf37d1df81dc361a6acc96
SHA512 e5462e6072607a2b752af2cef1cd29e7564aa76aa88f0e28b3555d160fc3b620293ba9b0d31944a56514662c3e1c510aa50d46afeb466283f74f0fe78f862a10
SSDEEP 768:UABe+Wqy1szYbuO5k/x4UbtS4gQESprTp8Xfv:UAkhqy1sQ5ix7tTgQESprTpK
TLSH
T109E23B43FED1D872C101C9F88E14D169AA3E76311D7598B7BDB82BCDEC7A380586D18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4596-9-0x0000000000470000-0x000000000047E000-memory.dmp

Download

memory/4596-13-0x0000000000470000-0x000000000047E000-memory.dmp

Download

memory/4596-12-0x0000000000400000-0x0000000000415000-memory.dmp

Download