bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
Size 69KB
Sample260925-3bpeta1yet
SHA256 bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56
MD5 41ac548b0bde11e42b1ab68ec90f8a48
SHA1 4e7acfb260af96d0489ce62b979c28dd6613874a
SHA512 5c44d6d720249ef6f21fdddb33baaa9288f5df546ad8a3973f2339177cd2c775b74577310ae5ae442426fdc202b5b31ec54c7b8131fade8f01b3288f6f52775d
SSDEEP 1536:7OqY1scLPFBJqO3IVsA+WzvT+2T6eosvFsZnN0ShqgM6:61tAVUkvTBTvjvFKiSkgM6
TLSH
T17363390BF980CC71E06D4DF88D29D199B9BB73705D2440B7BEAA5F8D89B92980D1C64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4292	jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_bf262e5081297ecb11990812275f3db51283e4309e6e65cc6a5347bbafa5bb56.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 46KB
SHA256 5da58c67ca45b092e238b6005a06ca9aa8725a7620f94e84c3fb8f816b19a2f6
MD5 430d6cbd8fdcf68a768ac570ba632598
SHA1 5fcc132446254a9f11abf446caf55e23cc0850e4
SHA512 a44512b9f1013eed12bf254d16fce60285a8c7b8aa2bf547ebf0f78938347c95af46de2ef3715fd67d122e2532f5463206e91d01eaf136466290e88c5862d398
SSDEEP 768:/OJqkF3IVszCL+LF7ovrwYT+2TdTovTSi3gBjBJFsZNj7xN0m7CVokwqN9uTq3Rr:GJqO3IVsA+WzvT+2T6eosvFsZnN0ShqD
TLSH
T1ED23281BBD80C971E06C0DF88D6AD198B8BB73705D2440B77EEA5F8D4A792884D0DA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4292-6-0x0000000000710000-0x0000000000725000-memory.dmp

Download

memory/4292-9-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4292-10-0x0000000000710000-0x0000000000725000-memory.dmp

Download