1031b17a3d1bb3889a5075d402788033f8584421b99c63e22a062d6e73cabaf9

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Size 1.5MB
Sample261014-eacgvse18z
SHA256 1031b17a3d1bb3889a5075d402788033f8584421b99c63e22a062d6e73cabaf9
MD5 bb10e7ddca513c25bbe388b7388bc0c7
SHA1 9821626813f307bb815c2c6bc84c178a2ce7b4ad
SHA512 9875f05839a37c1df3a0b8e8cd37661b35c3136161e1717c5db3f4f633bae9f669da82172fac01250e368b1a9ad2b9e9d71dd424263219d4f230583ec3c45c5f
SSDEEP 24576:iRSFRFf9jwdcpom2wjIOtRh15OO7r2AEa/VrijG8xDsukE25TSNTzq3jnOAJI5F:vnf9k1mh1tL15z7r2AEa/VrAFTkEHTG6
TLSH
T1CB65BF537281807AC4B611B0A61E4769EEF5FB614171CA0BB7C43A0D5F709A2B67E3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
3408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1448	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1448	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1448	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1448	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1448	3408	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_32b352bc0"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_32b352bc0\autorun.txt
Size 101B
SHA256 4a4e2725f44a4cb1539756f573bc6dad7ba1555d3bc202803c0287929658ed3c
MD5 fcde75717927ac04c1056b40cd84787a
SHA1 8ded4e223058c438d72fb46e97df70d6666fdc00
SHA512 bffb8b3fb755e99b450c0c2c726397c2442c40243babcaa6687c89aea5e88e8326d076f03cb37d91d4ad35b60a7f60a40ec532d3266c928ad1b07c37fb0480ae
TLSH
T1E6B0121C10208FCC244116AAC54032E2D270726895F0F55BACFC202F1F2624E0B3485D
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_32b352bc0\wrapper.xml
Size 692B
SHA256 424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
MD5 44601e00ff712607d2a0b64de786d843
SHA1 5696d1604b564a38669035faf395f78c933d8717
SHA512 7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1
TLSH
T1BC019E4D02E41CF339F6B591FAF632089F6391CF10B88C12BC9A028F452714184B3597
MD5 SHA1 SHA512 TLSH

Submit Download