58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b.exe
Size 64KB
Sample260924-dfvpysce26
SHA256 58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b
MD5 856c1e453c53bbff643f02289939bc83
SHA1 9a3fcb1814db8a9da69d472f7d021cf9c1f0989d
SHA512 273a7359296c731516a98643678520dd694f0cc4a978273745562a64c640d6a448a4032948c4a7aba1f239c36028cd322be67b0daaf196e46c57f31ecf251b71
SSDEEP 768:FLfjKUT/AMS7H21aMY1w9SGx12L9pCRv89egjSkwJf6ukGiaJarAX6/5dUSkeTIe:FLSi1Mw9X4G8UgjS7B1JaceiCP
TLSH
T13E53080B3E95DFB1CC0594F8E47943A683B2FEF687BDD3575B93810B8C29E4481A9168
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 5432	4536	jaffacakes118_58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_58570e851095cfab981e15d5f3b0159ff5add4ca3c66b36be08503dac10c0f6b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 979ff831c4e33a0302a97e8eabaced2e62015217dca2a43a7869a6ed9f348cd2
MD5 d8862ddad73ec9edb63648950bc21efc
SHA1 15f5ecbdccbea3c77b16c9eabc87333e7bc11764
SHA512 aa821e71d0ed6fc4cbe2e3f8fac76d2a321ea8c706c4e1e0c10f4a25859c70e5fa6a1251b77f28336731f68407edc7e74a776cb831d86ea538191055e9a72402
TLSH
T129E07D8482458C0D0800C89781739645CCA10DD2038D0FA94A318AE50B3B23D62D160D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4536-0-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download