639330a6f3113d611facfd511bcf04dbb6b748891f40e513f16edb07330d0762

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_639330a6f3113d611facfd511bcf04dbb6b748891f40e513f16edb07330d0762.dll
Size 24KB
Sample260925-wv3cfstakf
SHA256 639330a6f3113d611facfd511bcf04dbb6b748891f40e513f16edb07330d0762
MD5 fb6de9d06f8b78b6cfca00b9120021d1
SHA1 bd22028177c3a9feb17d0fd210f9e3180dd0e281
SHA512 e7e3496b8cfa4d347b9e5b918994f350d16acfd019e7c6cb50db90c06aa46cb2936062f8cc0e40e4e8489917a8f424a7326d32f6348a48ef93d5ea86492f4c85
SSDEEP 384:btecvtDMgKQh/mlTvhLlP2bgbfNbuQRXiA0CX9NSUDUtpYh87v8uc0+wn1GIW:RRMQJmF9leENbXyA0y9xUMoB+sGI
TLSH
T12BB24C97A6A4C8B3E062CAFC4D2DD17AF77931256E7508BA396B0FDED82D1420D1C193
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1092	4732	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_639330a6f3113d611facfd511bcf04dbb6b748891f40e513f16edb07330d0762.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_639330a6f3113d611facfd511bcf04dbb6b748891f40e513f16edb07330d0762.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads