6b5c18e583c858b6c889fe7630f581a7ba9877acace4e705ecf3f8fa8e3f997f

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Size 1.6MB
Sample261014-eawwhavx3n
SHA256 6b5c18e583c858b6c889fe7630f581a7ba9877acace4e705ecf3f8fa8e3f997f
MD5 d94290b20678c6397360d3bb845f89b8
SHA1 3f1a11b9107c95423a80445b6c34c3a2cc826ec3
SHA512 9e93560d85c378b9cdf3de95828b4e46a0c2993dac9ffbd0ba15a5353a7f60bd4cf63340a74521a8772bbc2661c9b0d6177a25098078d64de27ab9427486e45d
SSDEEP 49152:miEXUd3u1+bahtyWoTXD7IT6+i4oagcaTNzrL:0Ud3IcPITv5oag1
TLSH
T15F75CF537291807AC4B611B0622D4765EEF0FAA14671CE0FB7C5390D5F70AA2B67E3B2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1296	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1296	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1296	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
1296	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2924	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2924	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2924	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
2924	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2924	1296	jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.Downloader.Win32.Agent.ckxt.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_32c333280"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.txt

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c333280\autorun.txt
Size 95B
SHA256 3951c6f446b9cc48665f0a2f9c034712d20b032e206c7045cfb8b02413f40906
MD5 e979e708cc6e41f0e0ca5341b15eeabb
SHA1 acb9279aeb70c7723aacd563d30cd54e375571de
SHA512 db6bc4a03887d5f68a45e9ada32f28711e62fc8a92b9dd8312dac5d6af47ed5605788af81e2ae2b4ba2df69139ff1ab91e2ce67d93ef6d1ef002f90c938e09ae
TLSH
T101B01204000447CC11C4C49DA6420303B0202B2C9450F2DFFDCD352F2D5A72A0A84C01
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.xml

Path C:\Users\Admin\AppData\Local\Temp\pkg_32c333280\wrapper.xml
Size 766B
SHA256 357da15a7e543cf183942d2e0e125d8814dd2bdb225ac5fe7d1fae0601b4473b
MD5 7df4b6db3fbbd712d68509779b2ed8fb
SHA1 45567d458538587b85ac1dc399d66e5a56e77238
SHA512 6af8c86f81a07b5b7ea61bd11b64d3af1d92edddf80bd8ff28bd3d299cca86e8fc6007bb1c7be963715b439a16254136cba9aa9afb09ccca05eb111420c64c4f
TLSH
T128019C0D0AD859B72AF7BCA4EAE6330DAF27408F05B88C16FC4A028F452B18144F35A7
MD5 SHA1 SHA512 TLSH

Submit Download