7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
Size 54KB
Sample260925-2fbtvaaa53
SHA256 7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6
MD5 ecd12898ae1ba18c05f532e5e122d008
SHA1 89230267b37b87c7c5aadfe023be34cbed0425c5
SHA512 9b1b4c806e2ce0f755ce12cf6188a4fff36ca7588662a746bf1ebe5b28279fb48cead1cf12e9f5411e6173ebaeae1444cdec2d87701ae17949ad3d6175b56185
SSDEEP 768:7u/q8XpLszVoA5fBxsju4YDqRVsz5vZ7JbxuU000QqgyP005uunLNkHW:y/q8pLsCA5bhDqRVslE+0ZP034S2
TLSH
T1F7435B87FED1C8B1E010C9FC8E19D558AB3B39306D2451B6BEAA1FCDDC693D5191C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZPWUpdatePack\DefaultIcon	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZPWUpdatePack	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1196	jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7d072a61da8c8161896ae5c8b85a481fb3660bb85ea820593fb8385a2b8649a6.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZPWGameRecord.dll

Path C:\Users\Admin\AppData\Local\Temp\ZPWGameRecord.dll
Size 35KB
SHA256 2998f3024ecd11739d9221c04b24ea0b04f79dcffcb65d01f165463474fb9bcb
MD5 06face773c3eb5eab950ce18bc3671e6
SHA1 a1683329b5c5f41ff51469b2e60f87f353f25eca
SHA512 643da899c10896f0ce481f4d3f24e597af2569cf6d3a31e3ff505bb9c4b4fb2782f50a1b5c75ef1bbc8a9f99c5f9c0cb89d8150a3ecefe58ee968c8110b2bb30
SSDEEP 768:8ju4YDqRVsz5vZ7JbxuU000QqgyP005uunLNkHg:rhDqRVslE+0ZP034SA
TLSH
T11CF25A97BFD1CCB0E01089FC4E19D698AA3B75606D245166BEAA0FCDE8793C50D1D28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-5-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download

memory/1196-8-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/1196-9-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download