92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f.exe
Size 95KB
Sample260924-dbtxvscd52
SHA256 92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f
MD5 da0cd26b3260faccfe12915638c54455
SHA1 9fb2cd759abb6438daab7f982ac8f91c6f1dd7ff
SHA512 ae9b535d71a01815b53928bdaa9877c4359355f334a08296089015a400611051b6417b0d434bb0363ba61ed074cb6797382bba8744a71c7ef3c6dd8598a23004
SSDEEP 1536:rvgkDy2YAp/fNkFu1FsXHbSZ3ePhG4IUH/pEmCbfYKnXHau1dCBx7aXj1wBwFCOV:kkD9YQmSZ3k84l/5UGv7aXj1woCO82
TLSH
T16BA3F2E7CB829B80F97BDE3D6D36A8DC4A08C7BD0810A845FD0C4263CF664789678D59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 832	5816	jaffacakes118_92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_92210de091784434ae855e17dd8426b89fc24371e3981798cfba398add78029f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pcz..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Pcz..bat

Path C:\Users\Admin\AppData\Local\Temp\Pcz..bat
Size 302B
SHA256 ecf8246aebf7b3850e1a26ad26cd56c3006032656f2f46b0f3fe0316bf816e30
MD5 55a442938c95135a93e4bce38182cee1
SHA1 4dd54627893310feae6864bc30504a0448de542d
SHA512 7fe0a1d643781c391af1646d0de3c312a1590aea27448889d90e3ddf822a8748e08e2e83f74c6d76d6bdd7b4dfad682bcb2c884aae75a68ce4b1a6e4ebeb5f5c
TLSH
T1D7E07D12DE925E0C0C06D41F4565CBDCB0288C465B040B2443FAD0DA0F13815BAD5794
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5816-0-0x00000000021F0000-0x00000000021F1000-memory.dmp

Download

memory/5816-1-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/5816-2-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/5816-4-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads