fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
Size 54KB
Sample260925-2e8gesaa48
SHA256 fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe
MD5 ae9ac084c8b4f0617e8cddbe8f84b641
SHA1 c725c20bf6c3e5ecea3c34133e72e43668d0e897
SHA512 f80c1babb2837f827f1fd42df992f736641eb2eb352c4c57f9caf1be9ed9b01687a3f5eedfbf358c55907c8da4e034ec0d97002d6b9a33eae5cd6957c19718e7
SSDEEP 768:Su/q8XpLszVoGBOx+ju4YDqRVsz5vZ7JbxuUs2vm1wT3OlmhPuuLLNnZ:Z/q8pLsCG2hDqRVslEIvwA3LM4v
TLSH
T144435B97FEC1C8B1E010C9FC8E29D1A8AB3F39706D645175BE9A1FDDD8293D5190C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZPWUpdatePack\DefaultIcon	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZPWUpdatePack	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5956	jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fc2641f36ec337eff99f0bed75dd3128615d9f68a54e588d8befbe0d3d711dbe.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZPWGameRecord.dll

Path C:\Users\Admin\AppData\Local\Temp\ZPWGameRecord.dll
Size 35KB
SHA256 bd2aa1a7de9fd6f56a7b003fb30509fc4ef5568f74e344ecfa75b9b12a08f169
MD5 ada8d4539140450931f4a7a77f9a6f3a
SHA1 a0a30364372e9bcac8b386fb57e0189a83192791
SHA512 5b6c3184309e6d62833ccd6f3eb6250837c88f116025ef0e49852cf2acbd2c4a739375df95d40ec53fc804164391daa5f6d6548eabfdb7280eb36b60625f4ad1
SSDEEP 768:aju4YDqRVsz5vZ7JbxuUs2vm1wT3OlmhPuuLLNnb:lhDqRVslEIvwA3LM4R
TLSH
T19FF23AA7BFC1C8B1E021C9FC8D29D594663F75706D244266BE9A1FCDE8392C51E0D28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5956-5-0x00000000006F0000-0x0000000000703000-memory.dmp

Download

memory/5956-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5956-9-0x00000000006F0000-0x0000000000703000-memory.dmp

Download