6cd613942c811449440bf45503c4168a6e6e5c840b1b4f3f4115232d1ecaebb1

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 84KB
Sample261014-apavcssz4l
SHA256 6cd613942c811449440bf45503c4168a6e6e5c840b1b4f3f4115232d1ecaebb1
MD5 27b1265513b1460bc0b9467c65e5c40b
SHA1 59faaf30be43503a604cd96517a86c634abdb018
SHA512 b873f7bd4750ab61c64d4d04d2ceb755538ec46bc72ab86412754e43b0d315008f83a48d3b5cd9802eb5c1aa8fcf25f7c7c72ccebc6575ca4d998e883bdf9e6b
SSDEEP 1536:TZN+MmGFpVd9shzNiY/LbofLQ3F91CnCRJZuLMqqU+NV23S23:TZ8GFXAhNiYDboj8kLMqqDLy/3
TLSH
T17683BFA2FFA081B9EA876934496AF73351153F3B1971A541B3D11D873C35206CA39A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4624	4860	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4624-0-0x00000000015C0000-0x00000000015CA000-memory.dmp

Download