0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
Size 55KB
Sample261002-gtz4datvds
SHA256 0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4
MD5 0aa8482d317c2927aa92cc753a724d22
SHA1 73942f9bb9ee2d7bdbd12a9237fcb62ae50ab6b6
SHA512 da017b6c682a899041463431f9abdc4394a7838459424b873ef2151a296529edc25d88429eb175680d0b6fce9c0049300eda2381056b78aeb762164a71908ec1
SSDEEP 1536:GIqltmQ5mSL9AFgQv6qZ4Q3yMTEIeRiFX:X5i2gQ/4ayMTEpREX
TLSH
T180436C47F9E1C871D110DFFC9D26C16CEB3F3A701D285992A9EA1DCDEC6E291161C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
6136	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
6136	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\IEXPLORE32.jmp	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
File created	C:\Program Files\Internet Explorer\IEXPLORE32.Dat	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
File created	C:\Program Files\Internet Explorer\IEXPLORE32.jmp	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6136	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 6136	2444	jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0223b18a805f4738eca17502d485f27f78a053a744da95680cdd9700f75febe4.exe" K
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IEXPLORE32.Dat

Path C:\Program Files\Internet Explorer\IEXPLORE32.Dat
Size 35KB
SHA256 584a34f8f6f24a409e68da4b5b8ae5dbbd013c829412c9b7f85ccf4460cf1fdb
MD5 ba41d127d9a39ff6708e046017f752b6
SHA1 5904f5c5031c4d89de1deaed85388575d9b9f902
SHA512 0571f11df7fc3b0a6be2e4d12c57f263b5430bc4bfb951b068dc43f9151cb2303534afe1ee12d1c0507c5365c00053add2e3a5d52f0002f8ed2db21eb299c655
SSDEEP 768:6Qoi6qZO1Qegd2RxiQ23jMn9epODWydVGCJ3iFa:6Qv6qZ4Q3yMTEIeRiFa
TLSH
T1E6F25C06FAD1C871D100CFFC9E26D16DAA2F35B11C78599369EB5DCCEC6E291066C2CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IEXPLORE32.jmp

Path C:\Program Files\Internet Explorer\IEXPLORE32.jmp
Size 55KB
SHA256 7bcb2d7bfabdae309bb7c77ba25d62e7abbaae3ef697ac722129ada511762455
MD5 7917a540b0589b9bcccdcb0e2d6398d2
SHA1 53e3be93453e4799736be03f1774e838ac3b854b
SHA512 d7a310390312e58307835a557fa4d18b21f2f0d63c0c2e1973f25fd2dfdff4f524808a68e685c942ff4a2842cfb60f0b80e04677052c1160f18d50ff62370be8
SSDEEP 1536:7IqltmQ5mSL9AFgQv6qZ4Q3yMTEIeRiFX:q5i2gQ/4ayMTEpREX
TLSH
T180436C47F9E1C871D110DFFC9D26C16CEB3F3A701D285992A9EA1DCDEC6E291161C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2444-2-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6136-8-0x00000000006F0000-0x00000000006FE000-memory.dmp

Download

memory/6136-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/6136-10-0x00000000006F0000-0x00000000006FE000-memory.dmp

Download

memory/6136-16-0x00000000006F0000-0x00000000006FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads