936923180c0e474a058b7cd8813120b9bfccded074b7a97b86a894cc2cf51be9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__899dea32b52997225f727d55647275bc.exe
Size 308KB
Sample260919-lf48dsdf82
SHA256 936923180c0e474a058b7cd8813120b9bfccded074b7a97b86a894cc2cf51be9
MD5 899dea32b52997225f727d55647275bc
SHA1 6ba999e43e594e6d97aeeefe6a349199ace07e67
SHA512 6dc09fe05e28e8de2b075a77b0ef2ebe31b88b1ea10f3f935def7499567b706863d34573761d93349d821807c200ee02607be46ed66c4fabe3a16d567b8546ae
SSDEEP 3072:yKF9cje5oY484x15TAURRTQz4OUBZN2qPPQwPAarF9zxO7+KJ0sXdPfp:yKF9qoY15k8Tm4OUJDpiigPx
TLSH
T10B644B26FD0DEEABCDC9B330A2381A3D6A377B54CC190E61D778ED520572ECA5097A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1332	ugtocg.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__899dea32b52997225f727d55647275bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ugtocg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2160	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2160	PING.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 972	1792	jaffacakes118__899dea32b52997225f727d55647275bc.exe	90
PID 972 wrote to memory of 1332	972	cmd.exe	92
PID 972 wrote to memory of 2160	972	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__899dea32b52997225f727d55647275bc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__899dea32b52997225f727d55647275bc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\igtygcg.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Users\Admin\AppData\Local\Temp\ugtocg.exe
    "C:\Users\Admin\AppData\Local\Temp\ugtocg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1332
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddfogy.bat

Path C:\Users\Admin\AppData\Local\Temp\ddfogy.bat
Size 171B
SHA256 2780fd7980036cb15e8735c23b3b1709320feaeb595697dcd5392c8813e00b52
MD5 52de4d70d730059d83b201d10aa60e52
SHA1 2a25bceafd052e125ac5ba5cf159053c4275625c
SHA512 0165eb1d48b9231823b1c44e578db68e1d732ca2298eeca66158fb0be2c72bcadcd428b899183bcc8817332110de0f1911e0913bacd67ea55572a45b1801d39b
TLSH
T1B6C08C92CAC3DFAE8908913702782E8EC4694D493B4E3F20472AC4D911D681DBA97B12
MD5 SHA1 SHA512 TLSH

Submit Download

igtygcg.bat

Path C:\Users\Admin\AppData\Local\Temp\igtygcg.bat
Size 124B
SHA256 62ca93afa84d0bb4bb8bf6581f34fa903ec0b4dd0e114c87d55f6c9698d21621
MD5 af49f4b50f2fc096551d4329694618e9
SHA1 89f13b9c47f1889160f13877e35ad97fbd5ea83e
SHA512 53b8e43e6a4df61cb135da7c1740fbdc0c6195859ab4d473bb55c78d6e94e70020e63d4c12341b177e3327d2fcf977d6d112d45df0e0f45e3016ed8c1b86719e
TLSH
T1CCB09201C3C6E76D08C5F0670AF5DBCC8068CC597E553F148B108C8C7B56C0EB592312
MD5 SHA1 SHA512 TLSH

Submit Download

ugtocg.exe

Path C:\Users\Admin\AppData\Local\Temp\ugtocg.exe
Size 184KB
SHA256 5d6faf9909c474be6b3d2413e12072160d865bbfd3ed1b806f76ee807ae8497c
MD5 a431a8fa1bc2814f7a90e30308b48e4c
SHA1 ab1f5d9d4c2634b6d9931d3348befec135ce96bb
SHA512 6cdd5b0b921381f61ff83baed2f6429a6e12f937530a5af8d17e08278f71ce84e98b91250c797166fa933be8360db1a21fa504224ccfacdc1a61e2b06d641552
SSDEEP 3072:V484x15TAURRTQz4OUBZN2qPPQwPAarF9zxO7+KJ0sL:VY15k8Tm4OUJDpiiQ
TLSH
T1ED04D429BD4CFE9BC9C9B230A33C197CA9262B55DC190F65D738ED6201B2ECA50D7E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads