6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
Size 252KB
Sample260925-ylmlrawt9p
SHA256 6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb
MD5 928f599272da5afd88b475443852aa0d
SHA1 4cf8e70ddeb57a554b5bfe2f68240afa48d6682c
SHA512 d579c8af786922b6fad17bea3d2a7064bc823fce13efd184b5130689ccd69679c2f15cc96912897ef6bf1f380542d7dcf2f75f190be8028e423505383c8ddb54
SSDEEP 6144:aotnoMbGk5+LVd+pxXJSzOSGnQjOPTB49:nVGw+LnqVJh1nQjOPTC
TLSH
T1C944BF12F1D2C1B3D96A043949D58738E77AB2314F3BD8C3B7941F4DADA12E19A36389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	13909.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	13909.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13909.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
3500	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
2300	13909.exe
4284	13909.exe
4284	13909.exe
3640	13909.exe
3640	13909.exe
4376	13909.exe
4376	13909.exe
5172	13909.exe
5172	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe
2300	13909.exe
2300	13909.exe
6136	13909.exe
6136	13909.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3500	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 2300	3500	jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe	90
PID 2300 wrote to memory of 3640	2300	13909.exe	92
PID 2300 wrote to memory of 4284	2300	13909.exe	91
PID 2300 wrote to memory of 5172	2300	13909.exe	93
PID 2300 wrote to memory of 4376	2300	13909.exe	94
PID 2300 wrote to memory of 6136	2300	13909.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6039a0f5e856fb20986d35bf2bf1a75c6024fb10414de80892e81d07aa907ceb.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" up534
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" keep
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" keep
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3640
- - C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" keep
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5172
- - C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" keep
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\13909.exe" keep
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Roaming\Microsoft\dtsc\s
Size 50B
SHA256 abf11a8473d2744aabf5b04b82f6da5a2d356e286df9a34d998080526a6bf36d
MD5 809751837726d6031fcc3f725c938ff3
SHA1 837cb6c225cc4b5f21a576fb91c6e75a977f8b55
SHA512 df986b1b0a15bef3def5f1cde0f8e54d7bbcdc17e5ead52f77faa3ed771781840dd39522824b6a648ddf2d600ecc0478a10e45cfb0942f2e321e7624177e44cf
TLSH
T1C79004F4D531544540CF435530DD1D105013107C4D35FDD10D5D745C14413F41D00C0F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3500-0-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3500-1-0x0000000000400000-0x0000000000441000-memory.dmp

Download