e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
Size 64KB
Sample260930-m51ryade76
SHA256 e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950
MD5 58b2cc4171b2945c28c9e584b764bb87
SHA1 e0424062ffa609192967628f0953aa3b0d701081
SHA512 03eac8f71aa94800a09da613c1b4649c65ac84bf9b95417e96e3b178e120ed354210c47cdad364f0b93a32b42e1e0e7302a5a1945568a9b88eaa29c5a348e343
SSDEEP 768:du/q8XpLszJJ0pIOGqkF7aVsz9GczcFb4popEuYe3O7BD0bbltssJXc+IL+A:A/q8pLs4GqO7aVsZiIkB36YblGsdAV
TLSH
T15B534A6BBDC2C8B2D02C4EF88E25E125B92F37305D5580F6BD9A5F4C9D692844D1C68F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
260	jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e7e9e5b6370caaab45c41f90a91bc596ac06f6326ebaeba02d03adade7540950.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WowInitcode.dat

Path C:\Users\Admin\AppData\Local\Temp\WowInitcode.dat
Size 45KB
SHA256 169083d69ea83d8771bb80d74fdba1cbf70737be0b6f69455c4202dc651391f7
MD5 8895b3af1c7d2c656cd91a459ddaf8d9
SHA1 1669e7a44c5490c8a54f5d7409064c776b197821
SHA512 05a1c86326d54608f8758c1fb1520ffad25dd48321577647848b3e4bd2601921dad45872962fcf51fe27a13712e2f9930cc9673d8af1cc391cd61b239e670c9a
SSDEEP 768:XOGqkF7aVsz9GczcFb4popEuYe3O7BD0bbltssJXc+IL+H:+GqO7aVsZiIkB36YblGsdAC
TLSH
T11D233A2BBD8689B2D02C0DF88D26A456742F77305D6890F6FD8E5F0C5D792884D1DB8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-6-0x00000000005B0000-0x00000000005C5000-memory.dmp

Download

memory/260-9-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/260-10-0x00000000005B0000-0x00000000005C5000-memory.dmp

Download