29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe
Size 52KB
Sample260925-wt52ysty6m
SHA256 29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482
MD5 2333f145a05a5f45d292f4f925b61480
SHA1 d653db0b4b6cd09773960d0a3b5c13b88e253ccb
SHA512 10b5db6922dbf3fa689c24a5f3c47a55c6b60feccb73b55ebd46d07750205cf27daa2d80ad8faede93c68d7b3132100bfdf33b5330a4038012a8c402a321f5e1
SSDEEP 768:qYflMqyYlFx8agVEIBkXYlFx8agVEIBNevUu5qpG:qYNM1E+8E+TwUv0
TLSH
T143335D039B485AF3C30AA1767657A6BF277D7C3213A91D8B99E7CA41D807171AC39343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3392	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\SetupFolders\KAV7	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3392	jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_29910cc87a064570b50669cc96f6ed4efb633340157e58abd0c4ddde76c48482.exe"
1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd.dll

Path C:\Users\Admin\AppData\Local\Temp\systemd.dll
Size 12KB
SHA256 c9d9226358a5eebe0e9de4097ab7976acf9e136c5393d3e5ae60ddf550b110a6
MD5 891e909f8c5da45238e06508e84d0eb1
SHA1 771bb628514ba1c660ad992511360f835e1fa065
SHA512 e3276de9e1bf632d96c82ead7839d8b9f33195282cb6171d57500ac89d2e9f3b1355e7e06d38a1f51a8a76b3781593d7ea70cf67bb6301ca6c25c909a19edd60
SSDEEP 192:fnsYMAoC2fhPE85zo1AsEJOM/VETvD1H4QL+SkuE76v:fs2j85zgAxtNEF4QlEu
TLSH
T17442D7129B4896F3C303F1B2B68BB6BF556A3DA256991D87C8D3CB52D503260BC79302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download