33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
Size 103KB
Sample260930-ml4pgszfjh
SHA256 33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9
MD5 f6195853061ebf729326b96e141f8847
SHA1 0691a3ad7419181a4ae06b3e070100503c53b731
SHA512 dcdeb09e24e7096953096084e68a3471e8ae915dc36e5757d7827d85903169e0576f286724280dc9d64bb5a0557a4cbaa49d4d18758d50059aef22d62cca5594
SSDEEP 1536:wZbUgdmynhBbgA6UBDAdXSiqcBpjJMexoFZv1ISfKynxpX7XAa:wXdmGhXDdo5qgoPd1Kynxtwa
TLSH
T172A35B4B73C148B2C1D6013022893F3A657F7C718ED9A963DB5176862CBA8D6F539E83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4580	rundll32.exe

Loads dropped DLL 7 IoCs

pid	Process
4908	rundll32.exe
5536	rundll32.exe
5536	rundll32.exe
5536	rundll32.exe
4908	rundll32.exe
4908	rundll32.exe
4580	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd008.ocx	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\whh11009.ocx	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
File opened for modification	C:\Program Files\Common Files\whh11009.ocx	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
File created	C:\Program Files\Common Files\0E59B8E6ce.dll	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
File opened for modification	C:\Program Files\Common Files\0E59B8E6ce.dll	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe
4580	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4908	rundll32.exe
816	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4908	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5536	4720	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe	87
PID 4720 wrote to memory of 4908	4720	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe	88
PID 4720 wrote to memory of 4580	4720	jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd008.ocx" pfjieaoidjglkajd
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E59B8E6ce.dll" m3
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh11009.ocx" pfjaoidjglkajd C:\Users\Admin\AppData\Local\Temp\jaffacakes118_33ce55cb6298f6ea8267acb8af0b727250facd0f8da815e3cfb1c96229194ce9.exe
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0E59B8E6ce.dll

Path C:\Program Files\Common Files\0E59B8E6ce.dll
Size 10KB
SHA256 f8f3abcf8d43377b49d1edce23a667c9efd9cde86e9afee228e8c3b093013f13
MD5 f1f49fb85ab029ad86c02ebecb892b12
SHA1 664a602f8e843218c1158571714cd0adee1da939
SHA512 600810f5a23067afb483b2fb5cd980c817d1b79da7fd7c5183a2d76f3546c514256f5536791abd4ed4b949518c63ab7c55df3e9b9109df2681fd3df10dbd2673
SSDEEP 192:cjbjEyfon/ZtXNfKpF+vXXxbI/86uyvdo:H+on/ZLIsfhbIl
TLSH
T12022B49B26910663C9950F7412AA3A3D8C2B54F8435F7977EF50D8813CA60D9F63EE83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whh11009.ocx

Path C:\Program Files\Common Files\whh11009.ocx
Size 73KB
SHA256 87e379ab7ec37ff1513014828c630a4491e229158d4b5d52dac77dabc22f0a9b
MD5 65250c62cbeea8c00b497c499c405ec5
SHA1 87310e829c830225b32905d64027321cd49b2d46
SHA512 a7a38baf9bdd8531dad07d60fd858552eeb5d875e263492f52f426b0b500755233514ab8369d3bd5456f82379e83fe948146560b24da2bceb5a9f1829f2730aa
SSDEEP 1536:unhBbgA6UBDAdXSiqcBpjJMexoFZv1ISfKynxpX7XAa:ShXDdo5qgoPd1Kynxtwa
TLSH
T180737D4A73C188B2D2C6013012857F3A257F7C329DD89863DB6172466DBA9C6F53DE86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

whhfd008.ocx

Path C:\Windows\SysWOW64\whhfd008.ocx
Size 14KB
SHA256 672639ce00081bdd6b6ee69e1bc816d0b353ed9713b5a21bac6009907daf3d3b
MD5 731659d09654891912ac223e20cd10ab
SHA1 13cee04adc7b09ef1c0c6b9abc02d0c7bc02a071
SHA512 e2b63a180ff6a9ef523f21a9afe9f71f612f617fbab5b791f763c8bccab14d8cb1986729fadba4bc5f29fe9813766bcb88168018f8c6571ec72efc69639f1116
SSDEEP 192:59Fij7/vSyR07lego8slUOD9kkmZAJ5ihHbr:5rijzvVR0NElUODhdm
TLSH
T1FA52E9CDA7CA8252D1A3467026983A3752BBA4B44C3F226BE75459C53CB84E7E735F03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4580-24-0x0000000010000000-0x0000000010218000-memory.dmp

Download

memory/4720-0-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/4720-10-0x0000000000400000-0x000000000061E000-memory.dmp

Download

memory/4908-19-0x0000000002E80000-0x0000000003098000-memory.dmp

Download

memory/4908-23-0x0000000010000000-0x0000000010206000-memory.dmp

Download

memory/4908-22-0x0000000002E80000-0x0000000003098000-memory.dmp

Download

memory/5536-20-0x0000000010000000-0x0000000010208000-memory.dmp

Download

memory/5536-21-0x0000000002BB0000-0x0000000002DC8000-memory.dmp

Download

memory/5536-18-0x0000000002BB0000-0x0000000002DC8000-memory.dmp

Download