Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe
- Size 65KB
- Sample260925-3av6zaac25
- SHA256 a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad
- MD5 65ab71f22be3c7c6e50e66c880c0905d
- SHA1 15fee2b86e463b1ec0033b5772bd3276a36c3f7e
- SHA512 ff3388d4af1429e9d76f303e53fa35d77626bc14b12c9840692f09f6961ca61139869854f78aeb67cabbf2fc069f307bf372d83eac7d5ea25731100b2dfaee5f
- SSDEEP 768:N+OqoD1sz0cMl6jv+5qD1szHOhbZRTNjdb818Y6NxS+MBbk6W/rU8P2kjGD3:gOqY1sw5qD1sD2TzFYJQLUKGD
- TLSH T167535A57F9C1D971C01C4AF8CD15D698FA2B32786C2981BABDAA0F8C9D6A3940C1C59F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4392 jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a6a1fb1f65142ec7f678c66ab56b5592e929f4bb7345803c8830073f920917ad.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
- Size 42KB
- SHA256 02a3190ee557884c7700585a59050a3724ff59889087ab5f1ad55cb3ecce37ad
- MD5 54242e46bbd76fbcf5ced54d4e556c24
- SHA1 66ab8ed9e49013b12691f2c506675872e2608341
- SHA512 083057146a8335cdbe4c4b150380cda7371a1180d7c66b58ee3d14c27c1ca4c2736f59fc6d97464f80fd58bd9ae0cf7270c02b39a4addc2152830bb7f010c1f6
- SSDEEP 768:bv+5qD1szHOhbZRTNjdb818Y6NxS+MBbk6W/rU8P2kjGDo:i5qD1sD2TzFYJQLUKGE
- TLSH T181134A13BDC1D971D01C0AF8CD15EAD8F92B72786D2880F6BDEE0F4C99692940C2D59E
- MD5 SHA1 SHA512 SSDEEP TLSH