6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe
Size 81KB
Sample261002-emy7dss19r
SHA256 6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f
MD5 1b5c32dd2c13a49a055b47b0cc0f5d66
SHA1 f3da4ebf27a10d873e8c827ee00880f18608981d
SHA512 ce8304b98c6106f6a895803d909dd3b0609fadb4800d549d7420cedebbecf91851a62b09d132227d0550f63d2448bd660ef859a8bc546e7d1115db86df0e087a
SSDEEP 1536:FB6HEFyzOTvHn+vIJvsPNzdWFqfNyqSSBkHBzXET4j9gARoh+vNWzzzzzzzzzzzK:6Hs24vAINsP1dTNFSJHBzXET45gARohg
TLSH
T1A283AE53F2C244B5F9B58B7E3811E5094B77FC291A631B7A2378388A6D72392741336B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4300 set thread context of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89
PID 4300 wrote to memory of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89
PID 4300 wrote to memory of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89
PID 4300 wrote to memory of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89
PID 4300 wrote to memory of 1716	4300	jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe
  C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6d610c352da654585bf41e222dafdb03805d1ad683b99c717b7a65973dd7066f.exe
  2⤵
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-3-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4300-4-0x0000000000400000-0x000000000041A000-memory.dmp