b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
Size 53KB
Sample260925-w7fdfsvs3q
SHA256 b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d
MD5 ef06755c6a808a552a614f5ab48a9a56
SHA1 0b71c0b290047f928fd83762f1939e3fbc2d460f
SHA512 e69d5f064139a4dbf201207de1c84198f7028917f075f8f96015226a100ef574bce404705a93a99079c9f3b5c0240526309b6e437c1d3f44c4c837af1b83fc4f
SSDEEP 384:975gd1FsC0Gq1VUTE8sN0SlFebiz8fpZjDKPn7FPXTkYTF045:9tM+Gq1VUbE0C46IzDKP7tgYTF95
TLSH
T15233B5C6F69480A3E55A813C3055BE35BA5EC534B3B287968F2FC9E57CA5C81E833187
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
6024	GTH60363.exe

Executes dropped EXE 1 IoCs

pid	Process
6024	GTH60363.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
6024	GTH60363.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GTH60363.exe	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
File created	C:\Windows\SysWOW64\mmsfc1.dll	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
File created	C:\Windows\SysWOW64\ComRes.dll	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\fOntS\ComRes.dll	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
File created	C:\Windows\fOntS\GTH60363.ttf	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
File created	C:\Windows\fOntS\GTH60363.fon	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTH60363.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2168	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
2168	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
6024	GTH60363.exe
6024	GTH60363.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6024	GTH60363.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 6024	2168	jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\GTH60363.exe
  C:\Windows\system32\GTH60363.exe C:\Windows\fOntS\ComRes.dll ins C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b901b9ead7d862c99c6809f6b064f289899124e4d1c5bbbfff2ef2c03b43566d.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GTH60363.exe

Path C:\Windows\SysWOW64\GTH60363.exe
Size 51KB
SHA256 ce6bb7eddc83762c708d4a41709ae00371dbdc09b2a380f28fa60b1edf917473
MD5 2e068ce2770fde8d1af4cb114b98df1f
SHA1 b6f9c2775babb025b22f915c3047aa627d07c312
SHA512 998d695eb56375e63df7db16740b89deb2cf630ccbead8bcf84a921ec6f4a4f9aef2755b703f7190f332b2008ebcc949363bcf8f392d7d07246c255b5073ed35
SSDEEP 1536:6G9yoVEpHP29I3fbcJboSUge5N+CnC/maz9Rh:8pv2mbcJboce58wvOR
TLSH
T137336C236A0A49B3DFE231780A9D7232526DD862075541F7A61057EAFD243E2EE743CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmsfc1.dll

Path C:\Windows\SysWOW64\mmsfc1.dll
Size 20KB
SHA256 17fba410831c77a2cb36282454cb5b60ca56639e40add124a211e4d8c1f5028d
MD5 16153d3321d5ae42238304b30a367537
SHA1 0a7ee7b3464f6ea2aed2575959b613ac63844919
SHA512 60d38b5593822d7d574b4164d1330af24ed630c75f3061128ba9f54a029ea896ae6ae8f16af764d086c4f38195227b6f69b2f012aacbe66e33b0a35a28758d39
SSDEEP 384:h4WKi+1MvBbXSwWa0TINWe8WL0DBRJz7nR9z29:pKY5WLITt01Pzt9zo
TLSH
T1F5926E92E7280952EDDA6970219CF9573E3C5FD10B0050E79DD6E9941C663C2EE307BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ComRes.dll

Path C:\Windows\fOntS\ComRes.dll
Size 12KB
SHA256 aee4b909c0f0aaaec02692a7f64764e69682628e326581ac157efcccc7e95d47
MD5 623fda5d96c51f8e209f33d839657cb2
SHA1 b8baac5eb18af5b32c4bfc8b8da448d7860457c2
SHA512 10f23cf30cd59a97aaf68d44d082c340beb231ebeb3cf249dfe4b779d3bd466286251a94ea443ffef6edcf37be26b9b4c5881bb9c022e5898cdb23be0c10562d
SSDEEP 192:TYyjK1GUB1VUTEnMJsNC1nDzylFebeh5t8DTpy:N0Gq1VUTE8sN0SlFebiz8fp
TLSH
T15E424FD6F2D49883F14182BC11A1BD36B64F90A5A7674B226F0FE2D5FDA5C8289331C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2168-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2168-6-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6024-9-0x0000000010000000-0x0000000010017000-memory.dmp

Download