5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
Size 69KB
Sample260925-3bmk8a1yes
SHA256 5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a
MD5 47ee3131980be84ef2f3cd272d95efda
SHA1 14a4ad99fa76964788d8a017a9f4b39e6c7e0b0b
SHA512 a2d6976999cbce6f37c36188e6c039e1abccdd88f47f508e684c3ecd84a978c1b0c56669b3c75e50564f5ec2f1e32989aa30c99d730da392fbc251f628d07d5c
SSDEEP 1536:LOqY1scL6jJqO3IVsA+WzvT+j767n4cyVgQWqcx:q1t6UVUkvTJr4cyGQWqcx
TLSH
T173634A0BFD80C8B1E0690DF88D25D199B97B77706D2440B7BEAA5F8D89792980D1CB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2956	jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5d3f7fb271d6375a9511a16245acf765bc8ce242fdde7608b5d5b3aa8a0ff75a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 46KB
SHA256 240022e0639712f40fb36510aad7e28030a9dbc1921714c7e07439fc96377777
MD5 e6afb27ce9012ad19614e64ad291dd15
SHA1 d14831bb141cdd414ecc7d7863cb468d375bb328
SHA512 ba5b2bf0a204a39f86fbd0dee99c51764cc7715bc6297ae4eef8c71411e612a4447899d2947ed86e9992eec130f26eefc13f4ae381c5442740178e895609706b
SSDEEP 768:XOJqkF3IVszCL+LF7ovrwYT+kM767VhGTcyVvb7q7JFQ1kkr6uTqnM5:+JqO3IVsA+WzvT+j767n4cyVgQWqce
TLSH
T104232A1BBD80C8B1E06C0DF88D29D19878AB77706D6440B7BEAA5F8C497D2984D1DB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-6-0x00000000006E0000-0x00000000006F5000-memory.dmp

Download

memory/2956-9-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2956-10-0x00000000006E0000-0x00000000006F5000-memory.dmp

Download