0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe
Size 132KB
Sample261002-kmp7dattdv
SHA256 0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502
MD5 7cff10ab4e83a55c096bbf1d643bbf3b
SHA1 33ed48e474917702e4624d8ab833c1ff3f08526e
SHA512 a06d638f0d81287c423d07a25907c60a672207ba906a2a893b49faa3993f279bb319f419a5e61780d423382c47090384516f09e2ffeffde6526cd1b4ded9dc3c
SSDEEP 1536:49idyMByv9aykw9G4OtzSyHIZ1Ft6kqTFZ65CQLtlfKv:Hy+wI4Otf3kUIZLtlfK
TLSH
T1F8D39E267DA1C1B7D5C1813054A68F27AFFEA93209E79493CB4519493EB09E3DA3B307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\682ED6.tmp	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe
File created	C:\Windows\682ED6.tmp	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe
File opened for modification	C:\Windows\IME\SPI64.dll	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe
File opened for modification	C:\Windows\	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5100	jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0520c952caac2ad03df70cd6f1ab6203c680b33d0b33a8d4b06bb440af8c0502.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:5100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

682ED6.tmp

Path C:\Windows\682ED6.tmp
Size 80KB
SHA256 b579525bef0023da32c16003a0e70e86f24bf016682dc3dbcd9ea52da8d92543
MD5 b1cbfc896e144a1d31ac2afd05576edf
SHA1 7663cee43b0c66fbd2935a6c413bb42d64accf4e
SHA512 90719a9cf4413fe54e8469f22a06d4771119069bd641a5c815598d64507a5fb2f388ac21d5df561a2b2afcf281969815774aaa227368d2723e535ccd30a363ca
SSDEEP 768:ySxxmxuT8SGOtzaFhyHI5mrCSbqN1cAJV1ZchCqTFkA6neoC0nQ4B+oW8Om3Dxlg:yG4OtzSyHIZ1Ft6kqTFZ65CQLtlfK9
TLSH
T1D8839E25BD22C1B7D1C58138A4968B27AFFDAD324EF79453DB4209853DB09E3D62B306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5100-8-0x0000000000400000-0x0000000000422000-memory.dmp

Download