1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
Size 54KB
Sample260925-2h17hs1vcs
SHA256 1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3
MD5 24a8c904c2ad1e5cb49c5a47206fd089
SHA1 dfc40b7fbfcf3cf22072f723acd3c92051cd0725
SHA512 bf7ca912727f81ce19e3a0af4355ace05dc4064dc3f5c99938b80c92fce3d8e35e753c189e551c13e0694f909c73c7ea26841b8fef574f02b80ea4ac2e008e3a
SSDEEP 768:wu/q8XpLsz0os6gyxtHeHq51szazGUQYg2geVQDhWjs2YuHIFVM4C1uaRvfRO:b/q8pLsznoHq51sJ3hWw2Y9s4CkavJO
TLSH
T1CA435DC7FAC1D8B0D000C9FD4E29D158BA3F76702D259095BDA97FCDE8A93D1581E28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack\DefaultIcon	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2948	jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1767a989ed79946ae6caedbec3711ad4663971aeb6a8a94f4a78c266691af5d3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CPWGameRecord.dll

Path C:\Users\Admin\AppData\Local\Temp\CPWGameRecord.dll
Size 35KB
SHA256 0566ebf85621c7ef427cee92af1d82db232c49f4c7a08b702245acf84b43dc82
MD5 9d2f4042a273539c6a1b3cde0d148cf4
SHA1 89d8a303aa2dd214a4fb7c934ef8ccafa7c71b90
SHA512 1c9635c8bf681834876e6e581b0462ce32a5ec189a302f3d11b397b18b0e0376599575fec8a7e134c498fc6336f1a8a2a9c9c585da3d341535c6f447eef7547f
SSDEEP 768:CHeHq51szazGUQYg2geVQDhWjs2YuHIFVM4C1uaRvfRj:BHq51sJ3hWw2Y9s4CkavJj
TLSH
T179F25CD7FF81D8B0D00045BC8E29D5586A3F72B16D309556BDB96FCEB8BA2C5480F289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-5-0x00000000009E0000-0x00000000009F2000-memory.dmp

Download

memory/2948-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2948-9-0x00000000009E0000-0x00000000009F2000-memory.dmp

Download