514f67fb543abf14603c70e6587d335009e496152bec99c1084f3e50a40a8cb5

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 15:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe
Size 1.1MB
Sample261006-szxe8aat2t
SHA256 514f67fb543abf14603c70e6587d335009e496152bec99c1084f3e50a40a8cb5
MD5 4a5214f4728a86a4370e63f9e87bc1e7
SHA1 1bb04b9494259c762f4ba2988743eed9b27bec6a
SHA512 fe1bcb1a7c2e8523abb0f28a6b794e246683e746c3fc6093d48f083234b3658bba87aec593c2d55fbca98533f409029ab7640bf4dfd77ab8dd4c59b392c50e1f
SSDEEP 12288:bTMrNFb/yJzhHRyrFRj0Xv2272+5E5LopG1Tn7dvEIiVCiNWs6Ugb8nA57+HId2T:PoyJVR4ROu27tpkhs7NWFUSHHLs/B
TLSH
T1D8357BA8B762CC93F44140347029D7B0D5615E5A183AF6A2BDC77E4F37B92006A78E7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4788	jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe
4788	jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe
4788	jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe
4788	jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.cafx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-0-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4788-1-0x0000000000400000-0x000000000055E000-memory.dmp