28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
Size 30KB
Sample260925-ws3kfawzbx
SHA256 28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9
MD5 a0693df4f0566b80f0fd3aad47ce3f98
SHA1 bcd8b58e600d7a9db8a1e49584b37151e4f376b0
SHA512 d6e96ad0e86b43f1e7f1d2d828bd5faf0c3355c91d43c86e585d3315327c53687a29c26d8e212523a66a0c037767b2db051bc8f2a8bb580b73120d674470939e
SSDEEP 768:pHNJRRU0Hu7CFrWvpLquJky55+5/G6dTSDZ6DFPGorc:LX20QUahLqu/5+5gZ6DDc
TLSH
T10DE25C477A0488A2D0992234745E5F2B9A7F98387DB1DCA7CF2343D629A5283D97870F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
928	anistio.exE

Loads dropped DLL 2 IoCs

pid	Process
4672	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
928	anistio.exE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\anistio = "C:\\Windows\\anistio.exE"	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\anistio.dll	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
File created	C:\Windows\SysWOW64\anistio.dll	anistio.exE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\anistio.exE	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	anistio.exE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4672	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
4672	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
928	anistio.exE
928	anistio.exE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4672	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
928	anistio.exE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4444	4672	jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe	82
PID 928 wrote to memory of 4444	928	anistio.exE	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4444
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672

C:\Windows\anistio.exE
C:\Windows\anistio.exE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

anistio.dll

Path C:\Windows\SysWOW64\anistio.dll
Size 24KB
SHA256 fa5b8ae7aa5b093bd4b6641bac9d5ffbd097ae05b764467d4638a7b1c108f19f
MD5 3111173beadd4765fd23ed59f0122090
SHA1 66b86970b5e49cb0aff7a22c7ebc44f73facb060
SHA512 9c4ff45e0dd7fed92027da0e85758c64d881458bffddc4ce24535e3654e835a6006aec2651015e7e697f3d4074db7fab0933b0e32367a5bf0f5c4776d76bc0ec
SSDEEP 768:PCFrWvpLquJky55+5/G6dTSDZ6DFPGorc:PUahLqu/5+5gZ6DDc
TLSH
T199B26B036614C9D2E1A9623474AE5F3B993E98387DB194A7DF2343E129B5683D83870F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anistio.exE

Path C:\Windows\anistio.exE
Size 30KB
SHA256 28d65d3f77532e6a9954326a641955e2b3ad98c4780623233fb62121cd39f7b9
MD5 a0693df4f0566b80f0fd3aad47ce3f98
SHA1 bcd8b58e600d7a9db8a1e49584b37151e4f376b0
SHA512 d6e96ad0e86b43f1e7f1d2d828bd5faf0c3355c91d43c86e585d3315327c53687a29c26d8e212523a66a0c037767b2db051bc8f2a8bb580b73120d674470939e
SSDEEP 768:pHNJRRU0Hu7CFrWvpLquJky55+5/G6dTSDZ6DFPGorc:LX20QUahLqu/5+5gZ6DDc
TLSH
T10DE25C477A0488A2D0992234745E5F2B9A7F98387DB1DCA7CF2343D629A5283D97870F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4444-1-0x0000000001630000-0x0000000001631000-memory.dmp

Download

memory/4672-2-0x0000000000402000-0x0000000000403000-memory.dmp

Download

memory/4672-5-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/4672-9-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4672-7-0x0000000000710000-0x0000000000711000-memory.dmp

Download