cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
Size 56KB
Sample260924-d4e96sytes
SHA256 cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6
MD5 44ec2a4bb7c7c1195768ffca4b9d345a
SHA1 e96d606304cb1f169215aa83117db122d4fa6203
SHA512 ebdb8b0eaa64e80c223750f36c31dfbc1c226f37eb8fbb81c74ac543c466119d0ba31350e56e24674d49f5fa13a19b6e6b1800b83b8c5d49341df48d4822ea75
SSDEEP 1536:1pqUnpgWn/ne9FYC2RZdHQMzSXLLPzPv+mbHkT6ZjW5vXAgmQmoT:1zgWn/e9qC2RZdHQMzS/Pzvj0QfHoT
TLSH
T132438E13B8B18873D4C1817125F62F3A9F7FB86206629497DB40DED55CB16A0AA3B34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wxjhwr.bat	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
File created	C:\Windows\SysWOW64\bhqnbwlph.bat	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3976	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3976	PING.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1184	1752	jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe	89
PID 1184 wrote to memory of 3976	1184	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cee781d98e4b753c8f66e591fe73dedfa7212cffb5e514675410e955f8711ba6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\bhqnbwlph.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bhqnbwlph.bat

Path C:\Windows\SysWOW64\bhqnbwlph.bat
Size 100B
SHA256 946d5eda59687506c22b835b7074a061a8ccc174f41dff75f2777b49906cc0ca
MD5 0b8d46d29722cb70081bae63b3de61e9
SHA1 0567ee5b1be32112390f9c16d6ff7cbc2e43bc6b
SHA512 f3fbf01cf9f9e12d4dba15afec58fcfa5c5d4c55d067002f5c5acbbb487ee1c245994f38b12debe1055972d28241ced2cf10bb1515ee6db249e3e71da194f289
TLSH
T142B0120106B420E07874C8FB810F0B51073CF09A11260C2A13A03083EC00A0D0D31E7C
MD5 SHA1 SHA512 TLSH

Submit Download

wxjhwr.bat

Path C:\Windows\SysWOW64\wxjhwr.bat
Size 163B
SHA256 0a0979b68030711f9fc9be29004dfdcc6fe9c1cd5722c7193964629f65215664
MD5 fe54009fdb8716aa7facdb8c53ac2c31
SHA1 25c1589aeac968757f2f1c5d4efd98bb6b5084ea
SHA512 d77c48f2567c6c69a5119808a0565f7731ee70d447ec7d737bbbcb218c18148deff5afee4689407546bdc049a5818a576851afe5f0488d6e2953d7f2d4b0e6b4
TLSH
T10DC080776582555484007917417E220F905904C61B4D2B181701518D42534292943510
MD5 SHA1 SHA512 TLSH