ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe
Size 909KB
Sample260930-pgqyyavsfx
SHA256 ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5
MD5 bd7d341d166e5c7cf26fa456bd5bf76e
SHA1 cfd3de9fddd8abc8044b080708da5a2a586644dc
SHA512 8a0a4fa0a461797bf41efce6bd00a039d70cde0552444a1c6d3011112a931857502808198fbf0733f79a70927da9a0a68c5aea49a4bc549270e972b0961c1708
SSDEEP 24576:q9Vlq9m08OMNPjQqr4aJVggeMMyphkUvTrMMWi00Sz/7sx:aV0khOMZUqrodobvTrMMWkWzs
TLSH
T1BF158E22F2D09433D1732B388D1B8698A935BE253E289C467BF55E0C5F79A817E253C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~2\is240709781.log	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe
File created	C:\PROGRA~2\is240710375.log	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4256	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe
4256	jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ca6708f58bbb66ddae7962d14e3350a60637f99e3487c4df1f8a31c1443ac3e5.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bootstrap_41329.html

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\bootstrap_41329.html
Size 156B
SHA256 f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
MD5 1ea9e5b417811379e874ad4870d5c51a
SHA1 a4bd01f828454f3619a815dbe5423b181ec4051c
SHA512 965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
TLSH
T1BEC08C745B4A6A40413810C4701FC1482A2931C46823E9003189D2800A2537EE323EDA
MD5 SHA1 SHA512 TLSH

Submit Download

main.css

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\css\main.css
Size 2KB
SHA256 1f10099ca1415658743e0fd3d55f8263c4db88fb6b9dce02dac85f33cbf6cf08
MD5 5c364db19fdab190c4f752eb61c6c227
SHA1 e68ee96679f6554e72d184298930a849c776a874
SHA512 66ad25d655e4ec1085eb52d9fb8a196c4d31c4383e5290f0578125760f9763df7cdfa7947f1eb682ea3e575fadddd29ee3a93e67ab1e5cf56b5fbc5717cc575f
TLSH
T1CB51CE59C6976C8FB3061657B773BBE41E0144C69B0AD72DB2FA7574E18882838372CA
MD5 SHA1 SHA512 TLSH

Submit Download

progress-bar.css

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\css\progress-bar.css
Size 334B
SHA256 4fa0626be51bb23c2f302b5a4adc10d75cb71f4a3e9d765802bf73ae154046c4
MD5 c36b51181c5eeb60a208e52bccc01d5e
SHA1 2487694ff42dd4d6188aa6513ce45a0edd6e4b61
SHA512 b3a92ab6ec11c172a20d35d099837b8843558e1620b61322f54eacc8e27065f0ae8c8eac43a15e4c484fc99281c4c8c589e3e395de7f2d82e84468b4dbc60f1f
TLSH
T122E04F50DDE1A48F71461D2F37BA22094F0D9099A60F8A3E7E196170F31128838313D5
MD5 SHA1 SHA512 TLSH

Submit Download

bg.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\bg.png
Size 25KB
SHA256 2ccec5051aa6d444d1ee83fee02eaf42a9d1ec63160d2e450972d0c3e24fcda2
MD5 669d91db360e055e40a3909bdd4c2be0
SHA1 5966cdbce630e1eb545044a1a3d00abd9920f4db
SHA512 a44b3f21bd38ef2f2263451e08c67dc057c03635c6ff1d7d4f17852dca4d68f69cac32c6228fcbdf73947538b2457b770363081bc17a2a815dc981f27c0313b6
SSDEEP 768:58iLnIZtZo9cBV1ddiRqNwBPKC+BJedZwez0LWn7:KiLnStphjjNYKC+6dZlYLU
TLSH
T1AEC2D09AA634A56DFEDD81390FF38F0C483724CE729260CEC95BE4628C527936A04D5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

close.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\close.png
Size 361B
SHA256 8fa2f8a474e558c6bffd01ff0e88006449616fa721ce3179006a1db9801c1d8b
MD5 2b677420590ee8241686cf0c8cb0c106
SHA1 b72422bf04664ede9dafdb82244966adceb8c4f7
SHA512 64400e48c311be34cd57a0035dba1cac28fd9d84965fce53c9246832784ea07e3e35fe685220b2f07eb4dad9eaa5a27d2328d1b7ac0b93205fee55f2fb45a2da
TLSH
T15EE0C0CEAC445D25D984566768060334DC3F479E4443548C60FBD4359E3DB880BF0B52
MD5 SHA1 SHA512 TLSH

Submit Download

icon_better.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\icon_better.png
Size 12KB
SHA256 502e142da9a0f3afd5667a0ad22f434c77a7d98122fc55b848f2b982ccc25d08
MD5 605c34cd0e06ff2251f2bf2d0773e294
SHA1 642e9ad5bf7cf2718987b1af3736c13deb0c6f3f
SHA512 d158ec96bae874aa5f305225411a647795227afc0e300b5bd88bc152758698842966dedc886464555f9010a748942d808d2e5e31084c4912df7cb8ea268b128c
SSDEEP 384:FBbp0PO6Uyubi7hVm3Aw+r3i0hDRyLHeQi:fCPO6UyaiKABzfwHeQi
TLSH
T1F252BF33F5105A83CC325B6215C3D758FFB285BA4BA7B3F079E93257178F2489059682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\install.png
Size 1KB
SHA256 75dc22a1b90f3a3c33002271c0e71434bf2453ffd5569c765ccf4af8566ccfd6
MD5 2b20b7c03390a7a41911b3b2576be6fe
SHA1 4f77264803ae671207490704737daa2500feafcd
SHA512 87a113b467431da9343748ec9ca63971b3d6815bbd1b166f6423fc1af762fde4dac06115e4ac5732539930249193b6975348b1ce2e589e19308e22d2b662bc80
TLSH
T1B121D7C8F1D885F2DE4A02F60E230506939B23996E50AE895E4756DB8284D28C1E5E66
MD5 SHA1 SHA512 TLSH

Submit Download

install_hover.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\install_hover.png
Size 1KB
SHA256 ea7286ad0ec5256b599805a3ccc858bfa7d5de45519eb16897e796418b705276
MD5 19131d974934bd1b9f5efc18ff3a5d5c
SHA1 0697723aa514cf903ec35191877823d41773ad42
SHA512 5ad77a01198fb0cf374db82e2227f795c5d8fb0bdac7085d764c81cf8f1d2ed509f1e6b2552ae79cd6d6ff3a297c4d97977e37273f0e1e05e543818943cd5c8f
TLSH
T15921C8E46312A0972B828C93F342955094661FF2DCA0262C3D7EBCEE5F80BB610E4573
MD5 SHA1 SHA512 TLSH

Submit Download

later.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\later.png
Size 666B
SHA256 f05e596575a1b36bf7fead69ec9f95837fe7229acdbd147f07192ce1a07bd036
MD5 b24ad15a6b2718a7fd22b5f3e475ade0
SHA1 37205eb2d4c7f3bca37d5540aeae689a23a0fff7
SHA512 26b5b753962685a83dd38d5d2db4be46f6a3df83147b83f0fc5fa41f1a16777f13b80f4de28158d6b3b40815b871ccfaea4d59e80d96e5ae3a7f4f95de5c246b
TLSH
T14201C8CE3EF8A0BEF6144A213E804D04841A03D88606FC72194DA4AF2E8FC81D3F4783
MD5 SHA1 SHA512 TLSH

Submit Download

later_hover.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\later_hover.png
Size 695B
SHA256 3c415a2f6a6fd0816fb0adaf68e70030c1f738e22303f602d16fe38d1e98463d
MD5 bd5c5fa2ed8e223cd56883f5c9016c3c
SHA1 8890ca50e2f834d6471262ad5930a5895e76463b
SHA512 10e6248abb1cb019a39e1d0e662426f84a557ef0e95bd997da0b726a1a2181cec7d659f4ff0cf1b98c4fa6fd9c8453c46d9c70462133195b070372678dd44374
TLSH
T1B30144E9EC0473B50B35B06234D9983FA0338C5E4AB050E2827BC48566197050AA47C4
MD5 SHA1 SHA512 TLSH

Submit Download

main-bg.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\main-bg.png
Size 1KB
SHA256 f2813081788cb2573860206ca3208904374aa2ccb00294de0b73e6f955cfc3af
MD5 3559c0336ac74800ba9ea60ea0ed3a02
SHA1 f9cf2b6619afa4ebca369471682dada91a7b002c
SHA512 b4e7c8b5de81c8c13140ea1962048601edaabf23b39a4238b9699d195a2fff18537bba85bc440571bc7a7bf2155732d5e5690e98546f7363337c5932ab5d537c
TLSH
T1C931DAFD24270FC443B8253A9986FC4C494594ECD1EDEB7083E2CE19F82A5197A49BA0
MD5 SHA1 SHA512 TLSH

Submit Download

next.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\next.png
Size 1KB
SHA256 8f097777eb8bad5b30a3b6b16d01aef58ac7127a7ce49edb56ab492aa9256eac
MD5 0642817aa9dd2bdde2f87dbb1111517a
SHA1 faf14b0a1d6c79f574c6391baefd263c95ea702e
SHA512 582ae3ed0098506b29c5a0f1236d4e229a318a897b9e25093adb6311e086b8e8ed6086704fefd302ce481a62fc0d76f77a8d3dacdc56467f1b32fa5d2846b8fa
TLSH
T18B21FBCBA31315E8C9618DD140D18B3158836E70C46B35050C98A7CC7570DC17B6AF1E
MD5 SHA1 SHA512 TLSH

Submit Download

next_hover.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\next_hover.png
Size 1KB
SHA256 3d6ad98d32e11862843af5e735d6f5202f00140a5784f51e45dc1a1700996e43
MD5 4cf114464b10977739a1b3f47520669f
SHA1 2aafc4caf395134d8c6d1c957562bbc54c5ea314
SHA512 239ab81a2c4b560adc872447c5b095df497221474850a745ce57cf72fa1dc37ce41120cd9e93c23ca44df16b87373a095fc89ad9f7fbd8ad1193dd262859e686
TLSH
T16D31F9D2B12E720D784216528713AA9F8B93BD889306DC1C13333ACDB3B0A249187828
MD5 SHA1 SHA512 TLSH

Submit Download

progress.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\progress.png
Size 153B
SHA256 c388b032baee6032d1a76093c51c5eda840d0116da48336401b78a61297e64a7
MD5 80223145f64ca1caf3d884dfac4301e8
SHA1 155399ce252ef81f06351bb2adf44c21f1f37037
SHA512 285bf4b5c42971e150eae995479994bf7cccac8b2c7b8f5458ba2cb6b4e2cb4816b5be24c511d41bccca0944cebb931fd31d8bcccba33a503259ef127e90359a
TLSH
T17AC02BC563E88C36D68EA1F2E0050310F0F30B492312937994CB56502561AECCCD8B5F
MD5 SHA1 SHA512 TLSH

Submit Download

progress_bar.png

Path C:\Users\Admin\AppData\Local\Temp\ish240708453\images\progress_bar.png
Size 357B
SHA256 dbe72b4831ced3108d19f67869d82d0625d881f2ed3d34473a5f72235ff9dba4
MD5 a99fbc8fd32bb34c774d19d815587809
SHA1 ded0290e4b74fb363c2ddbf70291bac62dac18f1
SHA512 dc7fca5ab30e75d275b2b03ee69cbe59da9105f94caa39960f31c4e6d7f87fb107f0da66e3866ab8a6d132faa546e08aae9feae7fbfa8bb7c0314ca70779c723
TLSH
T108E0C0CEDB948A96A40C12B11DCDA808A4235ABA1562D638AF9CEA2524A7D850D5C3B7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4256-176-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-182-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-175-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-1-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-177-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-178-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-179-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-180-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-181-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-0-0x00000000004AE000-0x00000000004AF000-memory.dmp

Download

memory/4256-183-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-184-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-185-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-186-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-187-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-188-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-189-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4256-190-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads