90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe
Size 548KB
Sample260924-2ea6xstdje
SHA256 90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04
MD5 f746542d9c0665198978307c0b4d886c
SHA1 a89b3590943fecc58b706406779177683aeecc44
SHA512 e585ef60be34c0ceaa15b56b9249f889dba087dc962ab59c25278aa1d18ae0ebcac71bd60108db92c6b29497cbe9664b4567d84158424b4c2da0719ba789c05f
SSDEEP 12288:fPuBtaLhbC119e6Cc0zrzeEHFlvgY+888888888888W88888888888:3uBta9bCn9e6Cci3HTg
TLSH
T102C46D22A3E25437D17769359D6B81E8AC227D202EE5D85A2FF4DE0D0F397893C351A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution persistence

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3712	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3488	SCHTASKS.exe
1560	SCHTASKS.exe
1088	SCHTASKS.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1560	4356	jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe	85
PID 4356 wrote to memory of 3488	4356	jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe	86
PID 4356 wrote to memory of 1088	4356	jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe	87
PID 4356 wrote to memory of 3712	4356	jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_90a2cd43b89ad727e8f609a8e4213bdbea1403d04ef58c478161f0771e785e04.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TN Tasker /TR "wscript.exe /B """C:\Users\Admin\sec.vbe"""" /SC ONLOGON /RL HIGHEST"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1560
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /TN Wisker /TR "wscript.exe /B """C:\Users\Admin\nebp.vbe"""" /SC ONLOGON /RL HIGHEST"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3488
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Create /SC minute /mo 30 /TN Parker /TR "wscript.exe /B """C:\Users\Admin\AppData\Roaming\msddn.vbs"""" /RL HIGHEST
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1088
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe /B "C:\Users\Admin\AppData\Roaming\msddn.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3712

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

idt

Path C:\ProgramData\idt
Size 15B
SHA256 150e3e7a9764065ee02f76eb51bea6be01f201d476a9112f950e95c2b9fe14df
MD5 4dfb1d9e1856c35f2b0fcaba44a578bf
SHA1 ec3f764747438be9c60054ef6d429db0907d16bc
SHA512 772e922501bb080e9bf28a55be5d6c3c70773fb153a1d4d4ce150b6a9e195bd887341207ad6583226dfdf721459be88789337a136084f9ded88224b643a120a6
MD5 SHA1 SHA512

Submit Download

msddn.vbs

Path C:\Users\Admin\AppData\Roaming\msddn.vbs
Size 9KB
SHA256 1832f41936c14712475292aa457baa730b2f617cd0f88911de57de1056552e84
MD5 b06cf08f57922598ac35f6835d503724
SHA1 1f46204d5d01e3fc7b3efd57dacf75124a971db1
SHA512 9d19b3c9c9d32a367cf31a60d9071fd44099633d3660566057e9e6a2f16ff9afd13f2583ced886be5bd7825d6ecac9b49e1b2932b386cbb9b9e70f3afe09edd4
SSDEEP 192:J7LP3ZeNZ3sS1zS5QoItkzeSUrGp5S54lUzzEi5z0zzFzTl5m5BF5WPItkzb+N:Hej3sS1zS5QoItkznp5S54lUzQyz0zzC
TLSH
T15A128AA3565FFBCD01DBEA50636284D3903A2411AEE757382736886F0C5F46DFA8548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4356-0-0x0000000000476000-0x0000000000477000-memory.dmp

Download

memory/4356-1-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/4356-8-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/4356-11-0x0000000000400000-0x0000000000493000-memory.dmp

Download

memory/4356-18-0x0000000000400000-0x0000000000493000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads