4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
Size 51KB
Sample261002-gqps8stsbt
SHA256 4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e
MD5 d00563035d2f41ad50a1c1813941824a
SHA1 643c1bf77654b8051ba679dddad736075ed75ba2
SHA512 7e72d06ceb247124c9a1528ea079e69dc31048968ff4231815fc4aba486e8a2c6b2a9fa1d9a14d279caa1f3c7889cbae05c6a8d3901c1ee016614f039a8b284a
SSDEEP 768:4Cyoql1mQu2EdEDierFXKSqquxD0GQjgRJMeQ82cUVxkaevdhjQiu:Yoql1mQbKOtqquxD0GQSPQ8PF6Z
TLSH
T1E4335C47E9D1C4B1D020CBFC9D16C22DEB3F3A641E1D14A5E9EB1DCDECAE2911A1C646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2876	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
2876	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\IEXPLORE32.Sys	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
File created	C:\Program Files\Internet Explorer\IEXPLORE32.ime	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
File created	C:\Program Files\Internet Explorer\IEXPLORE32.ime	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2876	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2876	2976	jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4bb8cbaf5e51ede1ddef7e4b84693b9236dc80755d1563b22d57c48101515d2e.exe" S
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IEXPLORE32.Sys

Path C:\Program Files\Internet Explorer\IEXPLORE32.Sys
Size 30KB
SHA256 ff0e4154c18ad51c69a81a70feac9009097d531e97beda94d38fc41e0cef804a
MD5 5eb3e56cd993d4554594033961bc7e6b
SHA1 918ada2a675f5518c3e2e5b24fd9104bac825002
SHA512 83d0fd6cdeed0507f5fa81de951558a2768fde8be9d59294a55e769db22349d78aa0549a55799688328c1c2565bb19030a6d256e8e895e8c80aff473a6df05de
SSDEEP 768:WKSqquxD0GQjgRJMeQ82cUVxkaevdhjQid:iqquxD0GQSPQ8PF6K
TLSH
T194E24D46EAD0C8B1D020CAFDAE25C26DFB3F36A91D2D14E5B9DB1DCDDC9E242061CA45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEXPLORE32.ime

Path C:\Program Files\Internet Explorer\IEXPLORE32.ime
Size 51KB
SHA256 3a159847dc01d66f5c126936347fd0ad740e9d5a55995580ad844025c4128ce3
MD5 6f28f9d43e599acc1b8df35bd874fb96
SHA1 25e536317f07270f601342f0ca437abffae420ca
SHA512 67eacc5b02b199ad00532625f9e541da24d97174b16cd89272cac5211d4596dee81f9454cfe0a42e897980987ad11b593a297375e591cbe3ba3e459ff509eb23
SSDEEP 768:TCyoql1mQu2EdEDierFXKSqquxD0GQjgRJMeQ82cUVxkaevdhjQiu:hoql1mQbKOtqquxD0GQSPQ8PF6Z
TLSH
T1E4335C47E9D1C4B1D020CBFC9D16C22DEB3F3A641E1D14A5E9EB1DCDECAE2911A1C646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2876-8-0x0000000000600000-0x000000000060D000-memory.dmp

Download

memory/2876-9-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2876-10-0x0000000000600000-0x000000000060D000-memory.dmp

Download

memory/2876-12-0x0000000000600000-0x000000000060D000-memory.dmp

Download

memory/2976-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads