0b753490014ea94a142909b60029b6f98d36d2ac11d0a4ed16e5a3b36968269f

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:50

Target
jaffacakes118_0b753490014ea94a142909b60029b6f98d36d2ac11d0a4ed16e5a3b36968269f.dll
Size 16KB
Sample260925-wez76aga77
SHA256 0b753490014ea94a142909b60029b6f98d36d2ac11d0a4ed16e5a3b36968269f
MD5 bc2ab91728f6075e23f0da2ff2fcc40e
SHA1 250b91ebda5aa6562fea99fea07dabe4a62b80ef
SHA512 a1695efcb64ef8ce33a9d9d6a3fdc508d1ec51856b1a71f27aaeaa47a50dd95722e2055200910cc16629bcfe3e1cd2787a6c1f6c9218095c06b3b15c160185d1
SSDEEP 384:Ym2epUNN67VlMDFuTB+MpO0IShoweiu1WDE8vQW:Ymm76hnBLISho5Mv
TLSH
T19272C52367CD2CE3F868467434A62737457E7EB4066D71976BD2EC98483B123B63A603
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",C:\\Windows\\system32\\SVCH0ST.EXE"	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5164 wrote to memory of 1948	5164	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0b753490014ea94a142909b60029b6f98d36d2ac11d0a4ed16e5a3b36968269f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0b753490014ea94a142909b60029b6f98d36d2ac11d0a4ed16e5a3b36968269f.dll,#1
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates connected drives
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1948