db3a788c529ea3745e4da138c6c604213f1367aa73c6c2a4db0c6e22d7d1fcbb

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_db3a788c529ea3745e4da138c6c604213f1367aa73c6c2a4db0c6e22d7d1fcbb.dll
Size 37KB
Sample260925-wnqebashkd
SHA256 db3a788c529ea3745e4da138c6c604213f1367aa73c6c2a4db0c6e22d7d1fcbb
MD5 88502483867bcb7b46371bb3074612cb
SHA1 96d0e695e59119588b11e7938f6b911abff172ae
SHA512 0ce1aae0196da6cf6ab4a815019378c94edbf6ea878f08b1610dcb6a83511abf18d3bae0fd9c14dbd2605bbc2245d8ac633973c917ee3a04c7f42e75dc71b9a6
SSDEEP 768:HyoDFYKBRQ2Za40i2D1fOOyuSafSxi8opHyya:nY4bDDaaxnoPa
TLSH
T1E9032AA6B9A2C472F010D8FC6D2AE245FA7F75342D7124D7B5AA0FDD9C6AA83071C053
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5620	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 5620	2976	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_db3a788c529ea3745e4da138c6c604213f1367aa73c6c2a4db0c6e22d7d1fcbb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_db3a788c529ea3745e4da138c6c604213f1367aa73c6c2a4db0c6e22d7d1fcbb.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads