a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
Size 66KB
Sample260925-3cft3aac29
SHA256 a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287
MD5 9020f0c494b0b1a618c6ac817d4a2384
SHA1 a03fac8b2ed50905d6dea6d6d326d2255972ef02
SHA512 4b8e2345a957f870cdb9165aa4c9a3d49cc169b68b4a07cba2178e98efe2330c895a68fbfc5bf55d61ee77883d49f1705320a1b2f7df74c3f1a324474ffd023f
SSDEEP 1536:aeqopLs8hx/FRqOj9VsMmNbN/u7T1ub7bRhGwtjtZIfT:/V9zVwFhu7TcfbRhDtjtMT
TLSH
T11F634A1BB981D871D02C4AF88E69D1987A3B77702C6441BB7DEA1F8D8D792981D0C68F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3360	jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a719e13e21d6274a8f33ca4fd349ef33baa40e41bbfe995251dc92989c2ed287.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 46KB
SHA256 4953162af0e2fba2053cbfd77c257f445fa49afced49a2317bcaa25d5623d85e
MD5 86c5db2cdb25712265d4295ca06ac3de
SHA1 52d87f11a294f2925ebd11f1abcbeec425d4f900
SHA512 13ed5a4328fcd0c437d4c88743330f170ca04694920202c044dfc5b18ca7b26e3d0c7b18a384ea5700b77a4bec9c050f65c1d65801dc130697f1aa4ee2390db6
SSDEEP 768:cORqkFj9VszmLmUJjAFd+A/u7TfLrl/WbDtlbRhGr/uNzLDSaXTqCZqbDTXDw:nRqOj9VsMmNbN/u7T1ub7bRhGwtjtZIU
TLSH
T1AB234B1BB980D871E02C09F89E6AD189792FB7712C6841BB7EEA1F8D4D792580D0D74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-6-0x0000000000600000-0x0000000000614000-memory.dmp

Download

memory/3360-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3360-10-0x0000000000600000-0x0000000000614000-memory.dmp

Download