4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
Size 66KB
Sample260925-3chnnaac32
SHA256 4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638
MD5 4072087adcc26cf45a449399673fcda0
SHA1 ec777ad51c89b0ed77c37245b2bd339e856dfa74
SHA512 077707939e13fc6630aef44045d66e35ce538eec221a93cbaae7104c13d41a7d0f940eb7ba6ddd61a9edb5ce72179d6baf38e006cbdcb5b60a09335db8ef3137
SSDEEP 1536:MeqopLs8hA5YRqOj9VsMmNb+Z1KBF6lth1iNL14FLE:5VZVwFvBFuJiNL14FA
TLSH
T1EF633A1BB980D871D02C49F89E2AD1997A3F77706D2444B77EEA5F8D8DB92880D0D24F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4f333cc964909f65d4a80648d6915cbeb5e3357323049c7492421a6ed1198638.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 46KB
SHA256 7cb608fa40f780c0b0c9ed244414c85e290e54ef9e990a6effd33d65108bac3e
MD5 66dd1761c7118577ae023110b565cdf2
SHA1 d510b88a37aaad5e235b76c5dbb20d85820ed0c6
SHA512 6818edf7c1ec7204e2df338e261501666c3493f88f5f5a245bc892f9e60b02e044bc1876188dd9a00c0a6ec08e985ddd3ec3256980612c4e617a8d525d5b4d30
SSDEEP 768:XORqkFj9VszmLmUJjAFd+tZUkuEJgouLF6lSN8JAk13yNLltlTqbFLB+Y:+RqOj9VsMmNb+Z1KBF6lth1iNL14FLT
TLSH
T170235B1BB980E971D01C09F89D2AE289797FB7716C2404B77EEA5F8D4DB92480D0D64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4956-6-0x00000000006F0000-0x0000000000704000-memory.dmp

Download

memory/4956-9-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/4956-10-0x00000000006F0000-0x0000000000704000-memory.dmp

Download