Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe
- Size 62KB
- Sample260925-w8ylesxtf1
- SHA256 7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062
- MD5 a6d42d8162e28157143182ca241d1355
- SHA1 394026f7206397d8a324d286423c43afd852f3ac
- SHA512 17c926ec77d60c9fedcf22e5b204129cafc0dacc0ba90d07171f3d6733e0f4db10ef597d010409cbe562130092d8a09becac6603ef76ace53dc527d8ba5c8063
- SSDEEP 768:kRWguQ9S7MRPyt0L7hrj9TVr2rfsS2HE4qKQ7ov8b1aWbB:ZQ9S7oqtW7hrjkfsSqEF0caWbB
- TLSH T11A535B35A68590F6EF8E05707C1A767F9B2B752142A51A922F63EDD048B7361F43C343
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe -
resource yara_rule behavioral2/files/0x000e00000001c4c8-3.dat vmprotect - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1744 jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7928dc62b6aa39a9246fc49e6b151cfe172e90a82f98e21fad70df309c6a5062.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e596ba1n07.dll
- Size 43KB
- SHA256 8adc6971aea230f9c1df955f816af59bfd215bd6080d0389c454ea830d260bbb
- MD5 736e221a9d9565f8bf9e422b9b3699f9
- SHA1 79669eebfab9f7b54b553cf6a6a19060184a8f79
- SHA512 5e1e74628eb3097b118546fd3b6b216862db288df579f3a707a1367cafb0ca7d7fed036d22d9523f72ba2297d4e1c45e40114fcd4ef4804e03bb687687dcd458
- SSDEEP 768:29S7MRPyt0L7hrj9TVr2rfsS2HE4qKQ7ov8b1aWqB:29S7oqtW7hrjkfsSqEF0caWqB
- TLSH T1AE137D35A28650F6EF4E15707C1A7A7FAA2F651192A51A922F93EDD044B33B2F43C343
- MD5 SHA1 SHA512 SSDEEP TLSH