Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe
- Size 138KB
- Sample260925-wdgpessfqd
- SHA256 98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4
- MD5 10efe69d03807ce362918474a99bc30f
- SHA1 3f8d6f9e47720fc546d19c70496a2f943c2f7122
- SHA512 b3cff4b60ba9d8ceea6ec7ae9da3a00398af801797fc7f4b8165786343b565e312250e438994ff3de3d4488e50401282843cb8ec241373f6c6558d395b26b89d
- SSDEEP 3072:w5JxvpJLVIj+8LN/V81xZqi3oGew3E/hY6Ky:ybvpJLs+mN/Sc/F
- TLSH T10BD35B76F2C1F8B1D1A00DBC8C1AE2E49D6ABD302D291557B6EC1F8D9B792C119693C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Windows\\system32\\explorer.exe," jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe - Loads dropped DLL 2 IoCs
pid Process 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\explorer.exe jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe File created C:\Windows\SysWOW64\dab1.dll jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe 5740 jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_98e8a42ffc3eaf1d8a73a66422295f9d2db308f622358c0850749468453253a4.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5740
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\dab1.dll
- Size 106KB
- SHA256 dda2ad325158cd4342ed744f9d1e648b6a3310e0d032b1eaf00434f91b7a79c4
- MD5 9051f4f3447ee724c83aa49b883519c7
- SHA1 def5bac52b235b93f88a14da7fcd626ca5ebdd4e
- SHA512 6f5d6ac0774296867fe83446bf618192d23443f5f090282de428377ce61660fbba7020803a46a0931eeb79cefffffe6970027163bd78c3df1a1f7b59990afe92
- SSDEEP 1536:Tnq1QyCj+mfLUATanuRPxzV8dHxKM18i3ViG1ifpOFyaZ3E/hYFeVKy:iIj+8LN/V81xZqi3oGew3E/hY6Ky
- TLSH T16FB35B76F2C1B8B1D1A00DBCCC1AE2E49D6AFD302D2955ABB2E84F4D597D1C219693C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\logo.dat
- Size 61KB
- SHA256 997df3ab7b38549cd8f49871d8b3caaf2cd8ab7a5f80ce8d9950e6dff5c1a421
- MD5 44017b64bae7b5f3fbaa8e95236954d2
- SHA1 d181ceeb90367d5ea7a652934dee0c147a10ec43
- SHA512 ab54f79ae8fe21e5efdc45185e2818d5c7600ceeb545a2241cfa1da1c977fb1ba1b07ad8bdb058de9538e48a44634f33b5731aff8a53a586bb3bbc394db32c3a
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP