cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
Size 56KB
Sample260924-d4e96sytes
SHA256 cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6
MD5 44ec2a4bb7c7c1195768ffca4b9d345a
SHA1 e96d606304cb1f169215aa83117db122d4fa6203
SHA512 ebdb8b0eaa64e80c223750f36c31dfbc1c226f37eb8fbb81c74ac543c466119d0ba31350e56e24674d49f5fa13a19b6e6b1800b83b8c5d49341df48d4822ea75
SSDEEP 1536:1pqUnpgWn/ne9FYC2RZdHQMzSXLLPzPv+mbHkT6ZjW5vXAgmQmoT:1zgWn/e9qC2RZdHQMzS/Pzvj0QfHoT
TLSH
T132438E13B8B18873D4C1817125F62F3A9F7FB86206629497DB40DED55CB16A0AA3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ywiksm.bat	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
File created	C:\Windows\SysWOW64\zblchethk.bat	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3628	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3244	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3244	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 3628	4508	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe	86
PID 3628 wrote to memory of 3244	3628	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\zblchethk.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ywiksm.bat

Path C:\Windows\SysWOW64\ywiksm.bat
Size 163B
SHA256 0a0979b68030711f9fc9be29004dfdcc6fe9c1cd5722c7193964629f65215664
MD5 fe54009fdb8716aa7facdb8c53ac2c31
SHA1 25c1589aeac968757f2f1c5d4efd98bb6b5084ea
SHA512 d77c48f2567c6c69a5119808a0565f7731ee70d447ec7d737bbbcb218c18148deff5afee4689407546bdc049a5818a576851afe5f0488d6e2953d7f2d4b0e6b4
TLSH
T10DC080776582555484007917417E220F905904C61B4D2B181701518D42534292943510
MD5 SHA1 SHA512 TLSH

Submit Download

zblchethk.bat

Path C:\Windows\SysWOW64\zblchethk.bat
Size 100B
SHA256 5e07f1348fa8e1d380d80a40fc67b3a8abd900af19d41c232501a58166baf972
MD5 eb4800e65380e625c0e888d733776fbd
SHA1 ea0e38a16dd7bd52691ed0db54f26e5c3f91cc5d
SHA512 e288409a3cc19e8f48df84f220325d6a7ef4f2abbdb85a9d113eb52b951e7ef44d26c33895f86fa78eabd3e0d1ded21ed399a103f1d6ce8ed80d4ebbda671357
TLSH
T1AAB01206026C54E7C212A93C405D0250213CF196B144092741C810D9FC08C0A0F20D7C
MD5 SHA1 SHA512 TLSH