25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe
Size 76KB
Sample261002-gpe8eas1cs
SHA256 25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d
MD5 4f311cb0564be8c0e036160e09a0111f
SHA1 62e5f266b230c5dee3f7b5e8c4ea53ffc4489234
SHA512 4c66f12dc1c333cb6338d9fbec9ee7c441cb1596d52c244692513ed518868c454981119d8f71c08fdaaa7724bfca9e40226e2f033c7f63503985b17322ad4adf
SSDEEP 1536:vgO4iYQHlHKS5xWI3nT6tkBZ6YdzK7V3UdgYt7CRWee:mm5xT3TTBgMd19Cte
TLSH
T1C073090EFA855296CF93EAF4048D1659E7267E743AA11CDF1B8C4BF8B692C50C03A0F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6116	llllllllll.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\llllllllll.exe	jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	llllllllll.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	llllllllll.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llllllllll.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 6116	3296	jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_25af0af24d6d6d2a28865c613c7f7cf10c8a1e113954b733fca45d3e5aed8e3d.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\llllllllll.exe
  C:\Windows\system32\llllllllll.exe
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

llllllllll.exe

Path C:\Windows\SysWOW64\llllllllll.exe
Size 13KB
SHA256 edd4d1631481caa91020ead80765599281237c15580050ccfdc09014ac4e72f3
MD5 03f75cc6b09ba6835ea21308c87f08ca
SHA1 96f3773900eb216b41e0dbc0b33cffe1f8f1aec6
SHA512 fe8ec1cc2f3658b2fe0eb95059db94bcb20605e2583a2676a431b6078ac7669e3ef964118d644dceda8b5e2b9b33d4da698b777ce81ae83b2deabd2ccf7e87c1
SSDEEP 192:wRAMHwsq2NX/6Wj/sN1j8emp6nx3qJ87iKdlBmjHyBxJyUl3PJUD1YWBeO7:vjZnNYp6xmzyQiD6YWBeO
TLSH
T15D520886D348E87AF82278B0604E96BB96468004131BF5F3CF151D67F1B82C725726DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3296-5-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads