348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
Size 1.6MB
Sample260930-nrjryathjf
SHA256 348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a
MD5 8964bf8a3bd9e77e49ff8c90e3a0d14d
SHA1 461d19ef136235f23f8ffb5adc74a6e9aa59df10
SHA512 c1dbce797cf891ff3650846c4ea1bd104bab44dddb7d07484ad00fcb06bd36c14227065229b224a681bf5d1d94fd3fbc85182ff3d2cf627cecc3cadc76f6533c
SSDEEP 49152:ZqfouESz1iwMTcimKjAp3lgPRgXFT6trf:Zluviwuci5RgXs
TLSH
T10775C053729180B9C8B61170A22D4769EEF1FB6042718E4BBBC4390D5F749A2763E7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2572	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
2572	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
2572	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
2572	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
1812	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1812	2572	jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_348ac5a4e71e8cc077b5d08acfaa6b53d2d4f38d46613569b52e6254b407ff7a.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_b25343c10"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_b25343c10\autorun.txt
Size 114B
SHA256 1334449583ff7823df9ba97e57bed51eaaba21eed4551e25b07794f1d48c3e31
MD5 c819368178ce1e40fd55c813340a597a
SHA1 81aef3fd883c52de4fe211f3e43f70137cbccdf6
SHA512 753ce58ed7b76de63f8d68bf95949dfd772e805d0ab514f2706d72b2d504fb53e9beadaed0d34d933fee4f98d3ea13172c8b3a0e391bcab639c3d70003ec71a7
TLSH
T1B7B092864861438A28834C9A023227EAC090EBE88893E66A99CC2B1A0F272921914417
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_b25343c10\wrapper.xml
Size 942B
SHA256 ef43feb50e5bb1775195ca8c44f2af90661a6c06703c0a70c8e191bf9931c1a8
MD5 5c292748257ad5905629464778294451
SHA1 60881f97bf759d87c42fe388d35aca0f8d2164f4
SHA512 b1769d551421f119f92b62e5717565bb72e41f0288a0cc6f81621fd3a540dfc5370c7944c106499a0b474f50eeb6be8dbee5d3dc2618a8802ac90b73fde7aaca
TLSH
T1F2119C0D0AE419F32AF6BD61EAF6220CAFA350CF10B98C12BC49029F462718044B3597
MD5 SHA1 SHA512 TLSH

Submit Download