a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
Size 65KB
Sample260925-3azjdsac26
SHA256 a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165
MD5 5e42d46b3156488ead591bcb1fc681ff
SHA1 d24bec561045f75f6060fbbe45252893bdb3e7fe
SHA512 de1b3fa4d1dedc469b86e42a6401cd7a3ac8d22f9da893f64d4141d26029895e967f496da0f7c9a0934669e98b59b2e3c976ffd942962e8136f6789b9f878d97
SSDEEP 768:p+OqoD1sz0cMxxFj67v+5qD1szHO9bZRTNjQqWkhtIrabxK/fOosKjyxkfzTkbXO:sOqY1suTT5qD1sDiTzWsIrhXy6iXIF
TLSH
T152534947FDC5D871D01C4AFCDD25E599F93B32782C2980B6BEAA0E8D8C6A3550C1C69E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4460	jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a68145307ecd96b46e9126849295c8aa223c9a9b45cc492834d4359602d0e165.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 42KB
SHA256 03536746f520b2b394fd77c5f7fcff2abe27d6d2f403ccc81a6acd1f51f20bb3
MD5 820ddfd60b7d8fd1ea6a3cca1e16c9c8
SHA1 25df592f8cbaa7477c3fcb9a4473d3d1d4dc03c1
SHA512 f3ff536a8c64982a93bf1c7083fb105a13d84600a28e0129f37f17c98308538f67a92e9f12802f96ff3465efcf44c17db79dc229bb474480ceb4a454fcbddb5f
SSDEEP 768:Yv+5qD1szHO9bZRTNjQqWkhtIrabxK/fOosKjyxkfzTkbXIdP8:B5qD1sDiTzWsIrhXy6iXIO
TLSH
T1E4134A13BDC1D971D01C0AFCDD25E995F82F72792C6884B6BEAE0F4D886A3540C1C6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4460-6-0x00000000020A0000-0x00000000020B4000-memory.dmp

Download

memory/4460-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4460-10-0x00000000020A0000-0x00000000020B4000-memory.dmp

Download