84121e0886a69fb5171391dae42c6d5976d0670dcf3e94ee1521cf28a691b60e

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2d30cdbb5185000291fcb79452a9d96c.exe
Size 162KB
Sample260919-191jmaxdrc
SHA256 84121e0886a69fb5171391dae42c6d5976d0670dcf3e94ee1521cf28a691b60e
MD5 2d30cdbb5185000291fcb79452a9d96c
SHA1 ba55cb8e1785d60f23ebf3672af93d5582fa87d8
SHA512 86bfa1014125541b11e4ed2508b9d997ecfd44bf1b7051d7c8d6a4e3ff3fda8aef4f06681cc8cdea3e2a75c2e43a11fc9c3ff840065df22c4d7258c35c178227
SSDEEP 1536:0vn9DmOPj3/EyIR1Y+IjIVZgFNyifN/E3+gHurSwzMpE1gNYlVLNu:0l3TIR1YzNy8E3+dGna1rLNu
TLSH
T15CF37CAE1137F57BF072D53AC1B0E0F0B526FA92032A4F9751421A2AA75D4E18B3197F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3264	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2d30cdbb5185000291fcb79452a9d96c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 3264	3492	jaffacakes118__2d30cdbb5185000291fcb79452a9d96c.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d30cdbb5185000291fcb79452a9d96c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2d30cdbb5185000291fcb79452a9d96c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Otp..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Otp..bat

Path C:\Users\Admin\AppData\Local\Temp\Otp..bat
Size 240B
SHA256 2aab9a8e60e4639710598defe86b7550c608addaa1fee8b3dc4a2adad633e15c
MD5 d78dd82dfd225918fbc853e361197c23
SHA1 23ac41ce5f4f897587ef9d98b6d728b514d863aa
SHA512 c3f5a1d64b6e718cd015020d133294bc4e99318dcf42cd48dcdf9445ff165490e6868a05490fb9ba2f187186a4d7da476f985d351377c79f8ca404494fedbe37
TLSH
T105D0A76981864F180C14965743B35F4AE0589E4A1FDE3F31467284D4096111E62E7389
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3492-0-0x0000000000970000-0x0000000000982000-memory.dmp

Download

memory/3492-2-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/3492-1-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/3492-4-0x0000000000400000-0x000000000042D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads