46d0aed4fe78813959bc74802897c752c5a60648faff9019e12c235794ab081d

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Size 1.5MB
Sample261014-ea3n2sec98
SHA256 46d0aed4fe78813959bc74802897c752c5a60648faff9019e12c235794ab081d
MD5 e02db046c2e2e6dbe635dae7624fd3e4
SHA1 0989ac288f5c024273fc95dc5cc81094c6903107
SHA512 32d64fc9efaf1d567fd91c3f824700ef814768f7795b11a54f5de1bf874375a4b09c4b258255545f6f8f10014b2ad5ba303963f5375784f92990d5e04473530a
SSDEEP 24576:FdVFrJflRsFEjPZRzVQAOP650KO+G3nH4lAClKYI3R0OmzUlWdmAqo+VqflNTPAb:PNflYMZRWAOPy0K4MA7YI3R0OmzUlV3v
TLSH
T11B75CF23729580BAC8B61170A65E476EEEF5E66043748D0FB7C4390D9F20992763E3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4896	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
4896	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
4896	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
4896	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
248	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
248	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
248	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
248	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 248	4896	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_32d92b50"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_32d92b50\autorun.txt
Size 103B
SHA256 18569fc57ab8cbe782e381c77ff768b40386484fc8b1ce1dbdb8894e800ab14d
MD5 6e0b7bccb0a62d680ef362c7b89b4b98
SHA1 752dc05e76674abdc34981d7b2760383fafadc95
SHA512 d4085073cb4f9351411b5c4c46fe55e967c1020682fed5a9ab67b62af446e6a19fe0b36942547f805d7e2e6327a20962fd88fb3e0464c3e47c418775810a78db
TLSH
T118B01235140847EB1A4502BD02510333B01026B47559E26EB89D250F7E123470978075
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_32d92b50\wrapper.xml
Size 692B
SHA256 424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
MD5 44601e00ff712607d2a0b64de786d843
SHA1 5696d1604b564a38669035faf395f78c933d8717
SHA512 7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1
TLSH
T1BC019E4D02E41CF339F6B591FAF632089F6391CF10B88C12BC9A028F452714184B3597
MD5 SHA1 SHA512 TLSH

Submit Download