8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
Size 55KB
Sample260925-3dqqnaygnh
SHA256 8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648
MD5 f4edded010452d10a7ef9dd4886c3c53
SHA1 2c7bdbfc19ee8bf5249f4fcfa6a35da5f114e549
SHA512 afa2ee54a14aaa963b2e32bf7edf59911d77e541e9715d122cb475983316b9d12766736a32d9db7d17298e63f891179326dfbf1c4fb61b9ea95cc43c3d177b41
SSDEEP 768:Tu/q8XpLszxvzxW2FFe+Wqy1szsbuOCJkMXf+R5C4osXQVY1NFlAM:K/q8pLspJ4hqy1s8C24f+9sY13r
TLSH
T144435D53FAD1D873D104CAF88E25C179AB3F3A321D6585697D992FCDD82E3901D2C18A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5924	jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8acfdf9722653c399567ce520f371c72c9128b3caf696dc3acde71231becf648.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

textfont.dat

Path C:\Users\Admin\AppData\Local\Temp\textfont.dat
Size 31KB
SHA256 3148731af08aaec6b67cd069a529fc53a1cd8ea1a81a10f904c903b6634d467c
MD5 489458f2ee55b3e93b14522005e4650e
SHA1 395fa0f4310ca0b4d737c5748d80225464e3cba2
SHA512 ecb1c21f83511ef035edb0d5f2779f30218493d1315671eb1c77cd64fd8f157913381f572a19cc1424b9600eec0c82dab064d1a88220f609056ac621b309c8c6
SSDEEP 768:fFe+Wqy1szsbuOCJkMXf+R5C4osXQVY1NZ:f4hqy1s8C24f+9sY1L
TLSH
T1B7E25A03FFD1D973D504C9F88D14D179A93E36331D70896A7EA92FDDE82A3804D6918A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5924-8-0x0000000002190000-0x000000000219E000-memory.dmp

Download

memory/5924-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5924-12-0x0000000002190000-0x000000000219E000-memory.dmp

Download