9ceab1b1eac824f8b080eafe4d96d1cbd2c53a9fea7e0fabf2327fd44c1dac95

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9ceab1b1eac824f8b080eafe4d96d1cbd2c53a9fea7e0fabf2327fd44c1dac95.dll
Size 73KB
Sample261002-jb73dacd74
SHA256 9ceab1b1eac824f8b080eafe4d96d1cbd2c53a9fea7e0fabf2327fd44c1dac95
MD5 839028a4a2088b283f0ec24aea0e9672
SHA1 a4f00b400614e2767f48d3f34313dc76d6c0185d
SHA512 f75ac5e63f32b8d26412b90fa8fd6ed3b99f15414f9713621bd14bd36397ff32f1a8e4721210190d7db079b6858619662b117f2a37f968642a23a73d4122ddb5
SSDEEP 1536:gu1Mg7nYVHlLAdOQwoJxqhiqyxmmjC24w7/wVKr2NQMvkKVxJ98hWp:gu1XEHLAdOqJx0Tyxm7217/wVKCNdvHT
TLSH
T10973CF9D8269757BE776883AB8193727253911B22C4B605FD73311A83CBF391A718F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2956	4548	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9ceab1b1eac824f8b080eafe4d96d1cbd2c53a9fea7e0fabf2327fd44c1dac95.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9ceab1b1eac824f8b080eafe4d96d1cbd2c53a9fea7e0fabf2327fd44c1dac95.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads