64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 09:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe
Size 88KB
Sample261002-le54aseh33
SHA256 64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4
MD5 2593e594d339a736660e1902b29ae683
SHA1 78a26c7af7f9a555b5e5ed824eb259e9e8e3ea84
SHA512 6b38cf5e5c8e9ba1e217ea637aee154eacb2932ff44582cebac31405e7564bb90d891da7242ba911bf6d3182405a3048e92045a9ee9f4ce142d7d356626831af
SSDEEP 1536:53SUBESoaTgfL6tuk7/hCGi1iXbU8ZHqlDUro6XJ/Y/GF:IJSo8gUzF
TLSH
T1E39328A526A610F2D9730A73BE6C77F2D22C423209398651C75A1C1D9FF3CB7C7619A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1364 set thread context of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89
PID 1364 wrote to memory of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89
PID 1364 wrote to memory of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89
PID 1364 wrote to memory of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89
PID 1364 wrote to memory of 4328	1364	jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_64d8798158e0a2d2a117b11cb9aac25a5d2c9e5f6d0670977ba62f35354ddec4.exe"
  2⤵
  PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1364-2-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4328-0-0x0000000000400000-0x0000000000405000-memory.dmp