6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
Size 33KB
Sample260925-wtj5gstajd
SHA256 6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a
MD5 460a96daee33a030a0cb771849e9138d
SHA1 53eced9685cacf1125d75093f89b4d0bfa1330a6
SHA512 3b907443d5c0cfc67a134d58e51e81f0daf7b94388db7131f91ad533d478a718cc8e85ce7d7dbfcbbfbc795174f94b35c13bb207da06e63fbba6b9efe98db209
SSDEEP 768:TtBpjjjy7iVnF6x5LDsTgl/Za5qrGikPiTAPyryZdD:Lhjk5vsCIjJZdD
TLSH
T11DE25B1F5F4584B2C2ED4670B06E1F369D7F983428949863CB735AFA1C746A3E47920B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2084	WINSvr64.exe

Loads dropped DLL 2 IoCs

pid	Process
1768	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
2084	WINSvr64.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WINSvr64 = "C:\\Windows\\WINSvr64.exe"	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WINSvr64.dll	WINSvr64.exe
File created	C:\Windows\SysWOW64\WINSvr64.dll	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WINSvr64.exe	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINSvr64.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1768	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
1768	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
2084	WINSvr64.exe
2084	WINSvr64.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1768	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
2084	WINSvr64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4164	1768	jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe	81
PID 2084 wrote to memory of 4164	2084	WINSvr64.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4164
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1768

C:\Windows\WINSvr64.exe
C:\Windows\WINSvr64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WINSvr64.dll

Path C:\Windows\SysWOW64\WINSvr64.dll
Size 26KB
SHA256 150538f22bee6da2202fdd8ad7a9a3adae349c25a12846f58eabc71ecddb3a45
MD5 b76722d23d69789d24da16d9568cb822
SHA1 10321d47120210c7a178b9830b1c0550cf3e0b2a
SHA512 f4d78241ab574b727706ef1f47e03a55e76275ebfdb773d92fea5e8bff8311432c143346790a264786fd19a01f9695f14d2bef72dc20b59294683eb7b9e0a92e
SSDEEP 384:mnF6wmj1sivDsTg1P7/eqagJs7H1voOVfOrGikP1D9uTV2CAyryZhLHj:mnF6x5LDsTgl/Za5qrGikPiTAPyryZdD
TLSH
T192C25B1A4B0685B2D2EE4270B0AE1F365D7F98387C8450A3CB735BF91C756A6F42960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINSvr64.exe

Path C:\Windows\WINSvr64.exe
Size 33KB
SHA256 6b9658371126e669f90ec60553c2043ac16ada11c5479c3514bcce50acdb5a7a
MD5 460a96daee33a030a0cb771849e9138d
SHA1 53eced9685cacf1125d75093f89b4d0bfa1330a6
SHA512 3b907443d5c0cfc67a134d58e51e81f0daf7b94388db7131f91ad533d478a718cc8e85ce7d7dbfcbbfbc795174f94b35c13bb207da06e63fbba6b9efe98db209
SSDEEP 768:TtBpjjjy7iVnF6x5LDsTgl/Za5qrGikPiTAPyryZdD:Lhjk5vsCIjJZdD
TLSH
T11DE25B1F5F4584B2C2ED4670B06E1F369D7F983428949863CB735AFA1C746A3E47920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-2-0x0000000000402000-0x0000000000403000-memory.dmp

Download

memory/1768-7-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1768-9-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/1768-5-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/4164-1-0x0000000001510000-0x0000000001511000-memory.dmp

Download