6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
Size 63KB
Sample260925-fdnvqstta1
SHA256 6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76
MD5 4745af6d5c4cf8c82aa95f7be0d88639
SHA1 d74d96340dc768afa5182d37bd499199da3413ac
SHA512 7f7b907e0621578a280a46d19bc34d3372686966f587e7606f3235dd71753285c764a288ed5b199ec4e4df39eefd530fe1ec41f21135dfa9edd04c40d1e07784
SSDEEP 768:/Rp+Nul4gD7So9cOw1w8zw6dnXfNCeIw+UU0EKsyns7516B6aY61x:HKulrNm1zw6dnvZ+90EKsyz5
TLSH
T12B53C627A3010091EB86893206EFC5F75733BC1A2F47294E32C5AB7F2DA2D625D1665F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6136	webpnt.exe
4992	webpnt.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\webprint.exe	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
File created	\??\c:\windows\SysWOW64\webpnt.exe	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webpnt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webpnt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
6136	webpnt.exe
6136	webpnt.exe
6136	webpnt.exe
6136	webpnt.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
6136	webpnt.exe
4992	webpnt.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 6136	1148	jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe	89
PID 6136 wrote to memory of 4992	6136	webpnt.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148
- \??\c:\windows\SysWOW64\webpnt.exe
  c:\windows\system32\webpnt.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6136
- - \??\c:\windows\SysWOW64\webpnt.exe
    c:\windows\system32\webpnt.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webpnt.exe

Path C:\Windows\SysWOW64\webpnt.exe
Size 63KB
SHA256 6407d62d06317a08d8321a6f8acb5a86a701312031dd45b21fba197e93535b76
MD5 4745af6d5c4cf8c82aa95f7be0d88639
SHA1 d74d96340dc768afa5182d37bd499199da3413ac
SHA512 7f7b907e0621578a280a46d19bc34d3372686966f587e7606f3235dd71753285c764a288ed5b199ec4e4df39eefd530fe1ec41f21135dfa9edd04c40d1e07784
SSDEEP 768:/Rp+Nul4gD7So9cOw1w8zw6dnXfNCeIw+UU0EKsyns7516B6aY61x:HKulrNm1zw6dnvZ+90EKsyz5
TLSH
T12B53C627A3010091EB86893206EFC5F75733BC1A2F47294E32C5AB7F2DA2D625D1665F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download