a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
Size 89KB
Sample260930-l6q4fscc99
SHA256 a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab
MD5 647586b78450e9ce7b5ec0bce27e09ee
SHA1 0e3b8d560c7f839f21c99fcd6d21df7b7bcb7e44
SHA512 eb04d8cebdd3fd1bed7d6ea570cc6850680943589435d630e09d3e5e40a61b6035f22b578addb20dd21ca4b96eb542009770e85550eff8fffe8af87907839da7
SSDEEP 768:Uh/2JvcbY6VeOdPc7UYlZmDXuOabxZnGymMy49fM1AVMBRFZcCfqXvVJlUODhdm8:5qY6pdpWoDXdNPMy7CckbUgdm8
TLSH
T179939E8BB3459473C0D6033026563A3A957B6C741A69BCA7EF60B9C63CF50E5E139E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3532	rundll32.exe

Loads dropped DLL 7 IoCs

pid	Process
4212	rundll32.exe
3532	rundll32.exe
4212	rundll32.exe
4212	rundll32.exe
4760	rundll32.exe
4760	rundll32.exe
4760	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\whh10006.ocx	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
File opened for modification	C:\Program Files\Common Files\whh10006.ocx	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
File created	C:\Program Files\Common Files\0E59619Ece.dll	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
File opened for modification	C:\Program Files\Common Files\0E59619Ece.dll	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe
3532	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4212	rundll32.exe
812	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4212	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4760	1320	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe	88
PID 1320 wrote to memory of 4212	1320	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe	89
PID 1320 wrote to memory of 3532	1320	jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E59619Ece.dll" m3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh10006.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a77c47d1131935eed57f9dc22cd95395be7b6abb4d97778f8d9826f44ec822ab.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E59619Ece.dll

Path C:\Program Files\Common Files\0E59619Ece.dll
Size 10KB
SHA256 f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13
MD5 f1f49fb85ab029ad86c02ebecb892b12
SHA1 664a602f8e843218c1158571714cd0adee1da939
SHA512 600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673
SSDEEP 192:cjbjEyfon/ZtXNfKpF+vXXxbI/86uyvdo:H+on/ZLIsfhbIl
TLSH
T12022B49B26910663C9950F7412AA3A3D8C2B54F8435F7977EF50D8813CA60D9F63EE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whh10006.ocx

Path C:\Program Files\Common Files\whh10006.ocx
Size 59KB
SHA256 b365d15f61c743f29f811253adc67a7c231eaf0898e2a53e047367ad47e9b9c9
MD5 64ada7c19ed36c69f06a74578ca7075e
SHA1 7628f98547fdd34b3c1885a56d2b757d829dd0c7
SHA512 b0b55fd2d73746d83760b216401076eb776935650818d2cf2d751758987bf5fde19286be7dcc7fd0fbfbc3a86b6b2f3f5543d86c4009d347f94ad8ae402c8a2a
SSDEEP 768:4Y6VeOdPc7UYlZmDXuOabxZnGymMy49fM1AVMBRFZcCfqF:4Y6pdpWoDXdNPMy7CcA
TLSH
T11653AF8BB345D4B7C0D742302A567A2A557B1C342E64ACE6EF7075C72DF21A8E139E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whhfd008.ocx

Path C:\Windows\SysWOW64\whhfd008.ocx
Size 14KB
SHA256 672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b
MD5 731659d09654891912ac223e20cd10ab
SHA1 13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071
SHA512 e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116
SSDEEP 192:59Fij7/vSyR07lego8slUOD9kkmZAJ5ihHbr:5rijzvVR0NElUODhdm
TLSH
T1FA52E9CDA7CA8252D1A3467026983A3752BBA4B44C3F226BE75459C53CB84E7E735F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-0-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/1320-10-0x0000000000400000-0x000000000061A000-memory.dmp

Download

memory/3532-18-0x0000000010000000-0x0000000010214000-memory.dmp

Download

memory/4212-15-0x0000000002B30000-0x0000000002D44000-memory.dmp

Download

memory/4212-17-0x0000000002B30000-0x0000000002D44000-memory.dmp

Download

memory/4212-16-0x0000000010000000-0x0000000010206000-memory.dmp

Download

memory/4760-22-0x0000000002D60000-0x0000000002F74000-memory.dmp

Download

memory/4760-24-0x0000000002D60000-0x0000000002F74000-memory.dmp

Download

memory/4760-23-0x0000000010000000-0x0000000010208000-memory.dmp

Download