7601d9854a63ea5d471d26e499462374dece26e7b12aeb1733f24131cefb254b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__93742b06c5fc6a054a93951c1182e051.exe
Size 367KB
Sample260919-pt2afafe25
SHA256 7601d9854a63ea5d471d26e499462374dece26e7b12aeb1733f24131cefb254b
MD5 93742b06c5fc6a054a93951c1182e051
SHA1 35ab2f98dbe38d95df5f7255019080247ed3bda9
SHA512 3e1f9d93f52cc900e3e5c7a7d43f35a61f1905e8e562762a693292cc16fb66e72b0e9bfde3d2941af582c65c503c16c13f571bb4d25c40bdd1ff1a4c9d472a47
SSDEEP 6144:ycaHiBoNSqwDmIMzwp2IUjLBVi9ItvNGPzU6aMTnzI843+MO:AXtwDcz7r/vNGPzUPMTn78O
TLSH
T1658423234FE4A93AE45660B49833A6F352E0BD64052743533684DE2F3EE5B113419BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4132	server.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3228-4-0x0000000000400000-0x0000000000565FF8-memory.dmp	autoit_exe
behavioral2/memory/3228-15-0x0000000000400000-0x0000000000565FF8-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__93742b06c5fc6a054a93951c1182e051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4132	server.exe
4132	server.exe
4132	server.exe
4132	server.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4132	3228	jaffacakes118__93742b06c5fc6a054a93951c1182e051.exe	89
PID 4132 wrote to memory of 1296	4132	server.exe	82
PID 4132 wrote to memory of 1296	4132	server.exe	82
PID 4132 wrote to memory of 1296	4132	server.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118__93742b06c5fc6a054a93951c1182e051.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118__93742b06c5fc6a054a93951c1182e051.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    C:\Users\Admin\AppData\Local\Temp/server.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 31KB
SHA256 e85e290cdfc7c06eb74cefa0574c534ebef00b33fd872fde295ce30f0d2aa985
MD5 b00458d91b8315de0e2209f5933c22bb
SHA1 5f4caeee4a7ae77dfdf7a6c1844641f740edc4d4
SHA512 c158f99f18177105170717c0128d5b065a625a5b5ebd4c6ef37ae131d6db1ff64278845c9b8fed5fe3d5f3345213d4d632219d182e34dd15a1f73caff2d249d6
SSDEEP 768:zIPfXOhlKoLxtCt74y/842kGim5admgS0CX0MI:4CKoLD+h/84UimkdxMI
TLSH
T112E2E157469C8192C59B03BFF067DB852C2AD66083E88F252AFC16253D76E304F98257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-17-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Download

memory/1296-18-0x000000007FFD0000-0x000000007FFD1000-memory.dmp

Download

memory/3228-0-0x0000000000400000-0x0000000000565FF8-memory.dmp

Download

memory/3228-1-0x0000000000507000-0x0000000000508000-memory.dmp

Download

memory/3228-2-0x0000000000400000-0x0000000000565FF8-memory.dmp

Download

memory/3228-4-0x0000000000400000-0x0000000000565FF8-memory.dmp

Download

memory/3228-15-0x0000000000400000-0x0000000000565FF8-memory.dmp

Download

memory/4132-12-0x0000000000400000-0x0000000000408960-memory.dmp

Download

memory/4132-16-0x0000000000400000-0x0000000000408960-memory.dmp

Download