65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510.exe
Size 91KB
Sample260924-dfphyax1fv
SHA256 65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510
MD5 94ebac5a17468bc77282641a0c403940
SHA1 3149083dc5cb7dd4932d0b361e082c842fea924e
SHA512 2cebeed8c125e254fee24be7957372c659583d7db63f43e71ef405c5e370bbe04bdd3e032834b22dc9cae77eaa52e0cfd760e46694ae71a64e241fa00276e617
SSDEEP 1536:s2lG/BG9uDWS5ymwoFJHbtY2dKH8fUHMFE+MzNnwXaEfV4h7:s2la89Y5yDoF9C2djfUHM5MzOKn7
TLSH
T193936C4F3FFDDE71DC0014F6C938A6A983A2FBB6D749E2A75B53801E0935E4181A9478
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 6108	4312	jaffacakes118_65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_65e71d84ef367ce7e6c16a3d49fb9088605a8fca121de638fcafc23b288f6510.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 cba249ea930c87196ed1d8492a9da149c86dfae6f0fc05975361f2a3284f5a18
MD5 2b4a8f2c14e919855ebc47e5a94139fa
SHA1 255546591c969b80287451b1b113cb4aca45c9ed
SHA512 fe9bfd48e5cc29ac3afce976e525f4da65e55d9c65d98226dbf9d630a49f8472aaf26acc6d474f764c220bdb1bfd6ef6a6480ca39fb13875fe617a334c2763d2
TLSH
T1D7E07DD0FA024A481E08C41F857F573AC2614F0E2A9F2F051793C3E146454BC6AE21CA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-0-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download