77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
Size 65KB
Sample260925-3apn7aab97
SHA256 77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8
MD5 d37bcdbdb15a9fab77e865d2b6fe3356
SHA1 eae0625ab77f703a812bcc39ee0a497807728371
SHA512 a0a85811fcf4579499172ac320e32685731ceac87f491f219417832a4f85a02b9973278d336c8266bf045a5a156775298352871f6e1e537386db8ae1c4adedd7
SSDEEP 768:N+OqoD1sz0cMl6jv+5qD1szHOhbZRTNjdb818Y6NxS+MBbk6W/rU8P2kjGDo:gOqY1sw5qD1sD2TzFYJQLUKGE
TLSH
T1A2535A57F9C1DD71C01C4AF8CD15D6A8FA2B32786C2981BABDAA0F8C9D693940C1D58F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4820	jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_77f21b9f7c10d01b4604d031eed94f8a63eeee4b500b9c0553e0d1779a2e77c8.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 42KB
SHA256 52a70220f463b31ac7f49d8979836474f4933a52913cc1ec8a19fcb234bda339
MD5 6dbe36cb13cffc610e8fefde4769ca85
SHA1 ae6991e30fc1e7062feb4ba8012a3f27d25d4bc3
SHA512 70bd5069f5b7d9d874103acb66b6bc1105d94f79b7f58c42a2851eb5e4a150bbcc5457493ed863e68eb66a754500f9f41b91d03d2e02b4736b01147ea3f22113
SSDEEP 768:bv+5qD1szHOhbZRTNjdb818Y6NxS+MBbk6W/rU8P2kjGDD:i5qD1sD2TzFYJQLUKGf
TLSH
T130134913BDC1D971D01C0AF8CD15EAD8F92B72786D2880B6BDEE0F4DA9692940C2D59E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4820-6-0x00000000009E0000-0x00000000009F4000-memory.dmp

Download

memory/4820-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4820-10-0x00000000009E0000-0x00000000009F4000-memory.dmp

Download