d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
Size 56KB
Sample260925-29wfca1ybx
SHA256 d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f
MD5 73580d2f3398adfb91391d5128ffb326
SHA1 04a7fa353d640922ac5b4d7472475e4c6d87ced5
SHA512 5a28e85e2a29ef7eca6422b7ac5b917036de8fb1f02579ba514a104447a30fde05e26a0779606d21b524dadcf84c3872a9faf5b7106d12cdb03e2c8054af4ab6
SSDEEP 1536:B/q8pLspT/Akhqy1sQ5ix7tTgQESprTpIt:NVoTl1B5iJFwt
TLSH
T164435C53F9D1D872D100CEF88E25C169AF3F7A311D6548AABDA92FCCDC69390586C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3212	jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d672b6c7ef94f47651a243d0af0e2b2ad610d744d29dd7184a2a482d5307bc5f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 33KB
SHA256 7af347aabb6fd530e2be59bf0ccbba4a2da3e2337f66653fde41b1a1e5202adf
MD5 410c6a50601a35107826d54f9e421a16
SHA1 3ed727ccf0271fbb8d6f342908e6fb18baaaaa73
SHA512 1d0ea6ab78de3ae5c20990c0681836024c11410aa9d3e0f402520e210f7f92af5b12e5273d873eb99e4e7bf5df5fc9d04efd5d0746d14062e8db868b9901a8b5
SSDEEP 768:UABe+Wqy1szYbuO5k/x4UbtS4gQESprTp8Xfz:UAkhqy1sQ5ix7tTgQESprTpu
TLSH
T1EDE23B43FED1D872C101C9F88E14D169AA3E76311D7598B7BDB42BCDEC7A380586D18A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3212-8-0x00000000008E0000-0x00000000008EE000-memory.dmp

Download

memory/3212-11-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3212-12-0x00000000008E0000-0x00000000008EE000-memory.dmp

Download