8b108e81ff60b932e27be20c82dfa4d923c088c3252bfee22adf7de95171a940

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8b108e81ff60b932e27be20c82dfa4d923c088c3252bfee22adf7de95171a940.dll
Size 31KB
Sample260925-wdpp2aga25
SHA256 8b108e81ff60b932e27be20c82dfa4d923c088c3252bfee22adf7de95171a940
MD5 760cdf3d08e4bb59585d375e20ed5c9c
SHA1 3b90ba70815258495d4b72b9b7957dcc37adf8ac
SHA512 da9f0a47f32e1413b15aaa8cf8c346a15d0de54e07fbea3e9c0fd6a5dcd571fdf0d0674c59208674ade09b18b8a7c596b2bfb1e4f7296014afa907c2a43ddfd8
SSDEEP 768:XKS8qucQ0GQkjQeHmUGcwSNA49NMhnO2pr:t8qucQ0GQZZUGcwIA4z8n/
TLSH
T133E23B6BF9D1C432C060DAFC9D19C25AAB3B36355D5D24D6B9EA1FCCDCB9281190CC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 2480	5688	regsvr32.exe	88

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8b108e81ff60b932e27be20c82dfa4d923c088c3252bfee22adf7de95171a940.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8b108e81ff60b932e27be20c82dfa4d923c088c3252bfee22adf7de95171a940.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000000780000-0x000000000078D000-memory.dmp

Download