fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de.exe
Size 64KB
Sample260924-ddkrzacd69
SHA256 fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de
MD5 1e420b86081e4aa033473a30743bc524
SHA1 7c83321934394a42ff7ae8b426f02ad35d43d7e4
SHA512 9d6b72fc5b26e47d0e6f7e40d7ef0592943f7c7674d3e2c968e5bfe26089f63ea64d3fa4c687c3b5a45551fc06ccd4d9af4d84a96b0e0fd531dbb6db9f5a4ebf
SSDEEP 768:IWCHUgOD2CJpgMpxHQShxR2ota7iqPZii2JUGNUmUJ4bScQoG4DRSE1+sgcn01UZ:IWYdiqOWQR4ZiifGWme4b31vAt1UZ
TLSH
T1B153E91F3EE5CF72DC0058F9DAB852A647E2FFF28B59D25B9F03900A4835D9180A9169
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4660	3720	jaffacakes118_fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fab83cd646d2e600a4e03cc0802c5b750b73c0f41e11963a54f37fefa819e0de.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 ee27d75a1b3f01950730bb4e190c57380be0132aa2c48c37af06adf2fa660562
MD5 9a49b400bc3e54e6cf2f1db62d17270e
SHA1 f42f61d8fd253c21ca3291bef16afe0b3ad5f6bd
SHA512 13ac94599aba6b551daca8e3df8bd9156e632a9939227642a48c2c123c3bf9b04c602b0146b201911491659189d82920095f2db88424b4c01860dfc193679d23
TLSH
T149E0C2516081CE2A2D60947B46AE9EC7D0BC2FA72645AF7507A2C1BD994AC0835CA3A9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3720-0-0x0000000000560000-0x0000000000561000-memory.dmp

Download