1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
Size 66KB
Sample260925-29ladayfnd
SHA256 1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0
MD5 099f9efdcf0ebf2462ed0f8d49ea2562
SHA1 fbfc980b6af05c4b1e148e737130e070a2d681d2
SHA512 15d4050661c70f8ac5530d910c265bd6fe99d58704a3ee12762a63d879e11d86f9f4781cfe359d3feb9481161c66ce0199596ddba2de8c68ce1a9ecf669cf5e2
SSDEEP 768:N+vq0L1szpsba7+/Gr6Xv+5qD1szHOhbZRTNjFLwfkIy9rJabCuTF9MJRh8KQtNy:gvqM1sR95qD1sD2T7XIgYfMJRdQq
TLSH
T155635847F9C0DD72D1184EF8DD19E999F52B32746C2981B6BDAA0F8C9CA63900C1C69F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4164	jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1a99c823ba8978a8bab79754921aa91b8651255f093fb117897202f10b7287e0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 43KB
SHA256 affa2673b8d93387371f39642e0cab0407a78191631c5c3126d6f1e5a66d540b
MD5 a10fc44538bab5da0597bac9fdf1283b
SHA1 ce812a3ae57ca864e6e2e533aa8ee836bc895339
SHA512 ccf61bc39f3eaba28e3e88a2b620c7810adf029e6bf5a3e9624b4b1d7963101a8204e7dc419a6fb9082a06bc9a1f1d833cddbe724bbd3d2f0d6c666f18c11218
SSDEEP 768:Vv+5qD1szHOhbZRTNjFLwfkIy9rJabCuTF9MJRh8KQtNh:s5qD1sD2T7XIgYfMJRdQZ
TLSH
T16E133713B9C0EA32D11C0EF8DD15E995F42B7275AC2984B6BDAE0F4CAD663900C1D69F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4164-6-0x0000000000670000-0x0000000000684000-memory.dmp

Download

memory/4164-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4164-10-0x0000000000670000-0x0000000000684000-memory.dmp

Download