f3d4bc6bb17b4e0ce98b221c40927b1204dc1f907b045cc65727f7c1816155eb

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Virus.Win32.Slugin.a.exe
Size 124KB
Sample261015-2bfl8set3k
SHA256 f3d4bc6bb17b4e0ce98b221c40927b1204dc1f907b045cc65727f7c1816155eb
MD5 4a94e41906553c0f881500c0440a969b
SHA1 739433262bbf4c63efe61ae29575464d08fb90e7
SHA512 6102bdd8c3bd9a53134f0bb4c6fb6e74e5f3181622f92f82a8ddd3684c447aaecaa5b558ddbeab023b81273f8e0d7d950d79fc3a2a183f91cd7a16cc7d00e257
SSDEEP 1536:aD9FDUIYkK4cEui1gNNx0eW6QPB/4ZW1ck8zHhTduu+qjIk9WkD2oHxzt6:aDjhYZ4z1sxtbjIUWnoRzY
TLSH
T13AC35D01B6418076C1C301BD9626A77EAB3A7E7066609D87F7D07FA93E741D1AD312CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4368	jaffacakes118_Virus.Win32.Slugin.a.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\ws2help.dll	jaffacakes118_Virus.Win32.Slugin.a.exe
File opened for modification	C:\Windows\ws2help.dll	jaffacakes118_Virus.Win32.Slugin.a.exe
File created	C:\Windows\Wplugin.dll	jaffacakes118_Virus.Win32.Slugin.a.exe
File created	C:\Windows\explorer.exe.local	jaffacakes118_Virus.Win32.Slugin.a.exe

Hijack Execution Flow: DLL Search Order Hijacking 1 TTPs
Possible initial access via DLL redirection search order hijacking.
defense_evasion

DLL Search Order Hijacking
T1574.001

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Virus.Win32.Slugin.a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	jaffacakes118_Virus.Win32.Slugin.a.exe
4368	jaffacakes118_Virus.Win32.Slugin.a.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Slugin.a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Virus.Win32.Slugin.a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Wplugin.dll

Path C:\Users\Admin\AppData\Roaming\Wplugin.dll
Size 108KB
SHA256 9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943
MD5 8847a8302dacc1d6fca61f125c8fe8e0
SHA1 f399142bbf03660bee1df555ebbf3acc8f658cf0
SHA512 2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f
SSDEEP 1536:lFDUIYkK4cEui1gNNx0eW6QPB/4ZW1ck8zHhTduu+qjuk9WkD2ofx9t:7hYZ4z1sxtbjuUWnoZ9
TLSH
T11CB36E11F6028036C0D350BD5626A72BE7397A7126609D87E7E0AF793E751E1AE313CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download