330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
Size 55KB
Sample260925-2jm2aaaa74
SHA256 330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8
MD5 56d4ebd6736d56d03286467abcd17369
SHA1 20ab59f302ed3d2857e2cbbab9fd2fe8e02f6a48
SHA512 ae7bccd490f60da7c1298bc6cf3a53a2c5764a48df6faba3c91897b6033ff31614627276df8e31e0ab847d92b63087324da28c8f600c03fbceb8546a226406d5
SSDEEP 768:zu/q8XpLsz0o7fsxGbju9FqpVszaT7QguN1LmI4f0iEXA6tX8GuRRvEE:q/q8pLszaXqpVsVPmCXA4MFPvB
TLSH
T10B436DD7FAC1D8B0D010CAFD4E28D159AE3F36302E2095A6BDAD2ECDD8AE2D15D1E145
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack\DefaultIcon	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CPWUpdatePack	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4876	jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_330d6513663e5bd21c02e93d3c1d91e1211d904d77e3bdb2cbf2e0983a63dee8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CPWGameRecord.dll

Path C:\Users\Admin\AppData\Local\Temp\CPWGameRecord.dll
Size 35KB
SHA256 a0afc23e87b8b102e19df9c36d67181d8981c096de54f98e2ff337420f69a1c2
MD5 b3b9957e7a458e4d4834097894b78aa0
SHA1 1d7127ca61ad24089554ab1702a17facfa842bf4
SHA512 09b1d2acffaeeab613b1a47d5c37908afd09599cd9a81422b0b69d4eda928cb91fa998bfe61ed2e170341ee318cd46707222618d7bc8b95ab8cb8f8ae2efaf24
SSDEEP 768:Dbju9FqpVszaT7QguN1LmI4f0iEXA6tX8GuRRvEx:KXqpVsVPmCXA4MFPvQ
TLSH
T13AF25CD7FEC1D9B0E01089FD4E28D1556A3F32706E309A66BD692ECDD9BA2C14D0F245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4876-5-0x0000000000580000-0x0000000000592000-memory.dmp

Download

memory/4876-9-0x0000000000580000-0x0000000000592000-memory.dmp

Download

memory/4876-8-0x0000000000400000-0x0000000000414000-memory.dmp

Download