c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
Size 55KB
Sample260925-2jjc4aaa73
SHA256 c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58
MD5 6d6f847163618fd5513a9cc79e8fadd0
SHA1 f109d1cb3c1cd0e7ba47d5cdff57aac05d4f6e1b
SHA512 4e5d2319fa80711a8b7b10b5700a01f6088dbb63a5d9bf088861ebf8bb50045a65da5c4f8ab4581f4ef71bbff26d3f2d8eb6066aeda6009c58ef56e5c59278c0
SSDEEP 768:zu/q8XpLsz0o7fsxGbju9FqpVszaT7QguN1LmI4f0iEXA6tX8GuRRvEE:q/q8pLszaXqpVsVPmCXA4MFPvh
TLSH
T1FF436DD7FAC1D8B0D010CAFD4E28D159AE3F36302E2095A6BDAD2ECDD8AE2D15D1E145
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack\DefaultIcon	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2976	jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c279d31bea0d746c51379c82232b48a3bcd444449f84e7fb468ae4d2b6f61f58.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CPWGameRecord.dll

Path C:\Users\Admin\AppData\Local\Temp\CPWGameRecord.dll
Size 35KB
SHA256 419886eafe1b154bdfc82765b9897446cfc2dda45ae083b7f56d3d81e1a371e6
MD5 90201add63a52422165cda8d90e2b30e
SHA1 ac82f0b7f207bf1d29292bfd127a319b9874bd70
SHA512 7ce0ea94a7433aedf4a4cfe00c89ffd27c7d3530bf11babb42571bd752d5e489bffd72e5978ebca1f1664471672e6b47c28ab527b65339d84cbb83c8849cc7fa
SSDEEP 768:Dbju9FqpVszaT7QguN1LmI4f0iEXA6tX8GuRRvEx:KXqpVsVPmCXA4MFPv4
TLSH
T164F25CD7FEC1D9B0E01089FD4E28D1556A3F32706E309A66BD692ECDD9BA2C14D0F244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-5-0x0000000000900000-0x0000000000912000-memory.dmp

Download

memory/2976-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2976-9-0x0000000000900000-0x0000000000912000-memory.dmp

Download