03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe
Size 16KB
Sample260924-dpbcnscf94
SHA256 03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988
MD5 5db387c52f22b17da8afc81815325847
SHA1 f34269e3cf07ea99ed043ed3f7f9e439b64e259c
SHA512 1e3ce64418cc1efa16570067708e117566dd54884446ff8cc8e215d6c191b2f8916757705683534ac7996ec0993556c8de8caeef30b6926d9482ce6699330c2a
SSDEEP 192:uXsL1ZDraVVaq23yHd/kDOruK/qx+hgyHTw/Dm:asL1ZDrsVaUWkqpyd
TLSH
T18972C68B1E6AC0D2C9D4CEF123B44D6DAEB578314691D1D583B7CECED83834B642824C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2816	wscript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\msopt.dll	jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	628	jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 628 wrote to memory of 2816	628	jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe.js" //B > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe.js

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_03f29ce03692b072800f84b278d692bfb580484a94cf9a3af80acd1f74dca988.exe.js
Size 406B
SHA256 715769a61b81b34d3aa3bd73cd367c97ff52e655e042cb774888ca8ae50939e1
MD5 a63c3f1089589cd67354d5293c0cc154
SHA1 5c0d9495a448390f28782b10934bac74726f9ba4
SHA512 3db8b409586b1e86062f3e364e139048bb80194abc61c74863d54aa24473c50babec939f7c10c9a3b78dbdbc06fe8ec9d014d8436cfa0c0103a85a8edd31276d
TLSH
T132E0E508BD5BFF78CC504946A2B2CA4F91A6190822DCABD80641CF88283382A3565366
MD5 SHA1 SHA512 TLSH

Submit Download