da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5.exe
Size 48KB
Sample260924-dgp6vsce44
SHA256 da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5
MD5 4d8f5d845e6c79f58b13d7f7023ef324
SHA1 52d53018056dd3db320bf4c0e6b230053907b4ed
SHA512 30ce663cce2bf3d0c817f26d80a01cd18bd56327bfd425f3a55fe4ebeb757f16006df52c029e53537d1ab9743781889310f1c6129be51f31c60dc89210505c29
SSDEEP 768:UWfRmaLDlqLOa7+//lbzZd6sBv8aWltepEkLSyax7NYm:UWUaLDG7OlbzD6sOtww3Ym
TLSH
T164231B07AEC6D021D12602701D7446E347B7D7F84F8AAB179B8CAC4ADCA61935D3DB2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 1688	5656	jaffacakes118_da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_da0fa3848b9217cad725e57ee6adef4a656981f181c20980035f47b297edc4a5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 3be02cf1c6b666fe200f1dd23a0a620d10e1168f1613f4df9bc5ba79c8a55849
MD5 9ce0209cd78a4b9eab05684b6090e159
SHA1 b526da5e5e697c4822168bbd95adb16de3f629ea
SHA512 0ec99ebbe5c803ff19af25404ca60d30db500c49ef65903df4a22f3f879377c78f9252045e070912380a2ef9f6d7759b916a8a240adaf0dfb74720be227596b6
TLSH
T1CFE02BE393020F86C413BC1745A3C646A0900E5757C6FF2183B2C7FE7D93039628E644
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5656-0-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download