3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
Size 66KB
Sample260925-3cea8sac27
SHA256 3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3
MD5 13fd70ba46c74e37b05c322b7a52c727
SHA1 e29d7093abb7d516df7a057bed5278610f8f2db4
SHA512 6108366545d93c78db261ab19c0c5ae1dbd79d5e1605bb2c5f644047b09d8359ead55bdfe3dbbf4e72ea86e30a94dba67ee8f8018c043f21095806d92b18cf3c
SSDEEP 1536:MeqopLs8h+RqOj9VsMmNb+Z0ldL+Tw3dN+gWmRV0:5VYVwFxCTwtogpRy
TLSH
T1CE633A17B981DC71D02C4AF89E2AD198B93B77702D6540BB7EDA2F9D8D792880D0C64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3e5f3e5fa62ba215c9be4cf96139c57c9c142039959ae38a58764d9117a6f6f3.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 46KB
SHA256 1b9af39429409162dbb857c2e8dc87397b3efeace6f7f4eca459e39a31a44431
MD5 0f91f9d5d3083bb8cd7cf85d6eae3bf7
SHA1 9220af2eadeba993b79a7ee083d737558213b93d
SHA512 de626aa8b7ff1c96e07b0dd3d52aebc42a567521663de297c8f8505ca12df5e1c17c510d789cd60fc0cf2c422a28e446fdfdf23a31dc034660a124ef9d27e476
SSDEEP 768:sORqkFj9VszmLmUJjAFd+tZTBtQlF5pCHwMMVkTw3J7ZNYT00LjEW8TqWxF60:3RqOj9VsMmNb+Z0ldL+Tw3dN+gWmRm0
TLSH
T1F9233C17B980DD71D02C0AF89E2AD198796FB7B12C6840BB7EDA5F8D4D792484C0DA4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4436-6-0x00000000008F0000-0x0000000000904000-memory.dmp

Download

memory/4436-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4436-10-0x00000000008F0000-0x0000000000904000-memory.dmp

Download