17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c.exe
Size 64KB
Sample260924-dctcqayblb
SHA256 17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c
MD5 5f70d76adb0d8f3dd152f37b3dc2a244
SHA1 9d032c48913ce275ba62049ec4f7e7a920d41523
SHA512 d1393a10558a9d9d9abf231b599635e05aaa01512500a2ae2d3f9f9a2171b39c7fddb8b2b6329e32dcebe42e86167838384a8e023e007b1aab7f5c886d77d055
SSDEEP 768:qmhG/8FiDxP+ryiu0tzBh4qZwbWixNbi9qwp2CfwZm5bOtixpz2/gIIYOuv:qmG/xmdh4qFrjbx+bPOuv
TLSH
T1BC5307073ED8ED70DC0164F8E974C7A983F3FAF5A77AE20B5F92C01A8979D4491A9064
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 5460	3608	jaffacakes118_17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_17c822ef65dcb66fdfd70673e7396c9c644ae59319ddccb92c525636e67f867c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 f4676bbfb0dd02b90f228202aa9b365adcbccf00f50bb7d6e94b12b0233ec46a
MD5 eea5e6be6a15d6632ce71a9b14015533
SHA1 62b11089501d2395d075f4beacb155e88ff068b4
SHA512 730ca19a75d6e81e5d1628f327cba300a0e2dd666b29127fb8b1b2347719107324d6b0fb0948f1ea1384cf1c88e5f93151ed654cacdae1712dfa9cc211ca0d7a
TLSH
T135E0C2C251720A44651CE02B46B74677D0E92A9E37452B529A3284FC6EA243BF09B2CE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3608-0-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download