Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 12:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe
- Size 863KB
- Sample260930-pwsfbaydpg
- SHA256 2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0
- MD5 a2b7e3cafda940edb61064545d5e549e
- SHA1 530ab585b4d09080ee5901cb268874f03d554a53
- SHA512 298b8fe0011157928028080d7f855a0829b337031c10d0c2ee30663b907b5f592e7265052f001f96c281e93d26223a696d6fd846bb0dc7dff58b1ae3e651788f
- SSDEEP 12288:RmWWsG0MDVugbPXejoe54JgbjTJcw/Xb16i27BKDl+5WhK/44SisOoP3qWE8gJGG:RmWiPTG54JgL626iOx/4RiQE8gJG7zho
- TLSH T147157C11BEECC032E5A2D9F154285277D5727C207B3C89C7A3D04A2D6B2F6D09A3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe 1196 jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2dbbe51e894013f4297f098af5e508fb47bd2e2f0efc75b43c81751d63183ac0.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDTSLS6U\boot.bcf873[1].js
- Size 159KB
- SHA256 3d2bcdd7456339be3e9af1367655befca8e6291ef8656b2798813c41fe4039a5
- MD5 e65858c02bf984fe162fed4a8e7582ff
- SHA1 9a0c4f4d3222052f1a21797172e92af792b12e0a
- SHA512 69bf946ce5617cc97b8e95cdc7494fea935ab246528abd9507080c7d3f3f12110493ef9600c17b50c17e3c32ed00a5889c2de036d565bf220132dae1bb473ac6
- SSDEEP 3072:dka6cka6oGA2kqw+H1ud0lGMnTxcu8ZWJuDbiTRDUW:dka6cka6hA2dud3YGu8XDbiT1UW
- TLSH T1EAF35A957B91F0B367E75564C02F8002F2B91994BC0C84D8F31EECD168699CA92B7FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JM3B5PQV\script[1].js
- Size 248KB
- SHA256 0da45d20a63557b4d1f7ba646fde25538c65bf756cc7902b1d4c74019a93b1bd
- MD5 69bfa13d2367904c137f6136c57f19e1
- SHA1 7a5c65fd2337b9ed71f0d2db59e1f11d1005a164
- SHA512 8e6efa5f42cbdd02f35ab1a09ab76405dcb50230e94dcde520b78485b5903aae70b16244756a3575f821be23c07b2a54404cf00ef1881124e76a6d913be9c9d3
- SSDEEP 6144:L0fnOdm1ZD3Uum0JVRt/Rz2EdvQa4zmd6do:gfOdSZD3UmVRtZz2CzmK
- TLSH T1D144C74077C2B88002875FB7723BB1E5F82E8DD9B2C8494AF545FC98F5BA916E6E0531
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KNMT30O2\bat[1].js
- Size 54KB
- SHA256 4bebc12694755bc5edf1d849783992c7d470db7ede2b9cc74fa2dfd246c20aa1
- MD5 5523840e33b09bced0c852bb05f3f5d8
- SHA1 cfad993be90be3191d8214546cd15b0712350802
- SHA512 a3cea6e185a0c92d8c2265ef404a4a5abf0148d18c4d70c563603e8d9c2c7aa7d749f0649fcab87d02db79e6d0cb39b8095233a6c7975581195edfc7e47e2f14
- SSDEEP 768:YcMOGhicg/yNIh5HQm3mP1koLQBd1f6ybGVGOjJVuO1:TMOGkcgIE36LG1f6ybGMyN
- TLSH T1CE430B4333509A7646F9419C786A2903A336570E30BE70EC7A8CF8E5945DE4B7237B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUSZXXV9\gtm[1].js
- Size 617KB
- SHA256 93faacc28fd3b2740b1bf4b7cffe5ed1b2237bee6d4d8ae0b3cd423087e487f4
- MD5 f6300df56599325cb0a64f156f7293e7
- SHA1 879429be53634779e32b39e8c7d30d6aefdfde8d
- SHA512 6b1fa698bcc5207276b752bc624519389dbe4dbd2fd2235c908c4bd3a203cddabc8e1007c62e0e55201b40dc9ba16b96d4fb5ca8f23f9b85dac842725f205fab
- SSDEEP 6144:f6hLlnMeur5YuqQmKZ+eoyjhswogCnfFABQaVSEc9vsEYGbgEJx3Rmh7q2OBGp9T:fTeurvfhjhiqBrivsEW7EO9E2
- TLSH T17CD418CEB3C6747683A6B624903F018FA97E24E2B44CD895F189CCD42E3456A6163F7D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUSZXXV9\loader[1].js
- Size 206KB
- SHA256 56d9e5848849a67de46c16d76a4a54f25430d1de4dbcd59ecd3e5a3a0b3ae1a6
- MD5 5cd694820c64900e302407fb08a3ca40
- SHA1 fc84fb01e2fa1955228a893a904cb70ba551b181
- SHA512 05a1976b7282f413470371c29516d5e406dd9392ec440ce5278b73320a5b66a1b76264c62cb3846b4e3858c4a8a77fe5a5993a63f75449c8a6a742021c88dfe6
- SSDEEP 6144:ejFx8oI/G53QC+4L+6RNRkXSewtwVJwqn8Mzkh9CnBdrNoq2d8Sr4RB5KnrCaHyP:0A1QTe7
- TLSH T14D24002DDDAC247BA158B4B6C247B2F44ACD32A176FC54C8C9A24C1E73C5BAE643513B
- MD5 SHA1 SHA512 SSDEEP TLSH