4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe
Size 92KB
Sample260930-nnfaca1xdt
SHA256 4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b
MD5 e02d6042c77126367be383ad0392a1d4
SHA1 ef0804009ed0b5202089f09a5f82e6ac5555d398
SHA512 64b9e6a2e8bf542265b3634c0a352747b946dda375282fe8b1b011915280a76ddb6ecf702a72a44896278e73538f4ed71c3e9452b6a68de331fff88710ad56f8
SSDEEP 1536:ey4YBurAArxBrUIjVEyJ8Y8syX9KmQ7ff8K2EaPDaw+YSrjiQ8zm4zSet3xv:/0rxBhVEW8Y8syX9K9jH2rPDL7Sr8nx9
TLSH
T1C693E001FB656D9DF4B35FF41A787683C9267FB2927AC5494B00260B4A31281CB39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
2948	jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 5716	2948	jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe	90
PID 2948 wrote to memory of 5716	2948	jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe	90
PID 2948 wrote to memory of 5716	2948	jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4b0a0b0cfd45b5b344f1e4279e196d82fcbb28ee5defa819550e4736fc33ff4b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:5716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/2948-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2948-1-0x00000000006C0000-0x00000000006C2000-memory.dmp

Download

memory/2948-3-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2948-4-0x00000000021E0000-0x00000000021EF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads