35b6f781ef27ee433a9415f6dbe8cb5c846c73b3392859a2ac7ad15816eba4cd

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Size 1.5MB
Sample261014-eael8axzgt
SHA256 35b6f781ef27ee433a9415f6dbe8cb5c846c73b3392859a2ac7ad15816eba4cd
MD5 bd3460db4eca63904443eccbfcea7ba6
SHA1 e23d9320d10d5923798838067f01730b3464679e
SHA512 9330e1b070527c060dd1d403dfb850ea5adc142991c6ef2497089fca8484f5cb580f39b4be281e1d24f241c260389a78fd1736fef52af3b45eea2c6ad8f617cf
SSDEEP 24576:aRSFRFf9jwdcpom2wjIOtRh15OO7r2AEa/VrijG8xDsukE25TSNTzqujnOAJIUI:3nf9k1mh1tL15z7r2AEa/VrAFTkEHTGf
TLSH
T1BE65BF537281807AC4B611B0A61D4769EEF5FB614171CA0BB7C43A0D5F709A2B67E3B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1596	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1596	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1596	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1596	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2004	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2004	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2004	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2004	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 2004	1596	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_32c02a70"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c02a70\autorun.txt
Size 142B
SHA256 5b6b7564be8f29cb11b767822bdbbac32d1f248f52c89ff8d8e6653115de75bf
MD5 4b5f9a4d05848a42b1d8ddc1b6ebe39a
SHA1 2ee6a4d42347e60549de2473700beff3b66aa6c0
SHA512 e41e74bfc9a2b5604c56619ef493aa7813fdfac6a474ff2280b7ad0b00083f57ff5127c4313a5517c423dc963741e21918d3135d8cd66b447fbccb18da2d6bcb
TLSH
T116C02B8AC80003ED34802C05324033F1700467F90803E0068FC8206F0E1271103F1427
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c02a70\wrapper.xml
Size 692B
SHA256 424ef303f88bcd0c6af1858cdacc0e3225545957fcb6c49110e39ff39b26b7f9
MD5 44601e00ff712607d2a0b64de786d843
SHA1 5696d1604b564a38669035faf395f78c933d8717
SHA512 7328a2db19fc89d43a4c6dac7338ebf71dfe418bf3bd5bf04966afa1cd76cc7c73daeea07496c7df425ad369f6b17ffcbdf3b2d5de7e7d70424621d9375b73d1
TLSH
T1BC019E4D02E41CF339F6B591FAF632089F6391CF10B88C12BC9A028F452714184B3597
MD5 SHA1 SHA512 TLSH

Submit Download