b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
Size 31KB
Sample260925-xfsedatgqa
SHA256 b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5
MD5 b234ef9e6bb32524862c2f22f4cb7878
SHA1 47206ba3fc0a143663d10dcb3233ed0c3a0e578f
SHA512 67365414045ecfe7fdc3b4fc9c4961867084fcc3e1f197840c14e33868f44d4bf73db268da2c48095d5b4e92db96931f4d0900450bf6228f7077a20462199819
SSDEEP 768:orGHn4AQ83ol0KhBliWh2Ai5xODiskhz8GfW1G:/3YlDwAiQiLq
TLSH
T12AE26C42260140E2C2EF437074192F3B8FBE58796B94B9EBDFB307C65DB4293A52460B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1716	WinForm.exe

Loads dropped DLL 2 IoCs

pid	Process
996	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
1716	WinForm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinForm = "C:\\Windows\\WinForm.exe"	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinForm.dll	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
File created	C:\Windows\SysWOW64\WinForm.dll	WinForm.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\WinForm.exe	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinForm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
996	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
996	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
1716	WinForm.exe
1716	WinForm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
996	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
1716	WinForm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2140	996	jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe	80
PID 1716 wrote to memory of 2140	1716	WinForm.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2140
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996

C:\Windows\WinForm.exe
C:\Windows\WinForm.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WinForm.dll

Path C:\Windows\SysWOW64\WinForm.dll
Size 23KB
SHA256 c5b400251ff18d8ab94142054a88d60331510ee2427e8c10edbbc2a9f4a4488b
MD5 527173e40de81869a76f13df896bcfd7
SHA1 71732cbf86a1f6a08e9fea41aa137edce9e227c6
SHA512 6c4954f6381408983ce487cc1061cd7ed9bcc6b605180ec50127fa5a05f9a1e0f53d05e2ae2198534b864b88cd38279f7cf21a87867d54cb51d4cfb224b973cc
SSDEEP 384:bEFNClepKh4DbkjDliyjuK0lMIfAi5xoUfEDLAPsqDaankkhNc9eGP2MYdLqGfFS:Zl0KhBliWh2Ai5xODiskhz8GfW1G
TLSH
T116B26A41260580E2D3EE5234B0693F678FBE8CB87990B99BEFB703955D75193E92420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinForm.exe

Path C:\Windows\WinForm.exe
Size 31KB
SHA256 b01e844d345a6c62aeeff26559339d096fd390bdefb2cfadb46cd684eff627d5
MD5 b234ef9e6bb32524862c2f22f4cb7878
SHA1 47206ba3fc0a143663d10dcb3233ed0c3a0e578f
SHA512 67365414045ecfe7fdc3b4fc9c4961867084fcc3e1f197840c14e33868f44d4bf73db268da2c48095d5b4e92db96931f4d0900450bf6228f7077a20462199819
SSDEEP 768:orGHn4AQ83ol0KhBliWh2Ai5xODiskhz8GfW1G:/3YlDwAiQiLq
TLSH
T12AE26C42260140E2C2EF437074192F3B8FBE58796B94B9EBDFB307C65DB4293A52460B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1716-14-0x0000000010000000-0x000000001000A000-memory.dmp

Download

memory/2140-1-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download