31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe
Size 25KB
Sample260924-dzesvada39
SHA256 31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a
MD5 867784a847c872882f4de326f8009321
SHA1 1bd8ddc59fcebce13ec667038d54e85f35a929f0
SHA512 d1fa1ddc807c13e35ce2190d0fac88a9bf669391ede6ee901367457b734aecd2f611a6a8afe7f66846e1f5ba1a69edbc4f774f0519ce56655babf31894d34b2e
SSDEEP 384:bClHW7aqkyIQist5pYHa7psWThhZaqd6d4EhaVvRfELlfmfpac7UB:8WmqyQTtrwieOZaqg/aVvIu8coB
TLSH
T18CB24A5AEEA1C8F2E0401B7C9E49BA3F177B7721251D04B279AD1C8ED949384270C3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Drivers\beep.sys	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe
File created	C:\Windows\SysWOW64\Drivers\beep.sys	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Delme.bat	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\Ole.exe	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1216	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3544	1216	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe	80
PID 1216 wrote to memory of 1412	1216	jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe	89

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3544
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_31e61d4a2ff7a5001a66fe609dbda998024a87dbf23b98f62cb613308fa5491a.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Delme.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Delme.bat

Path C:\Windows\SysWOW64\Delme.bat
Size 276B
SHA256 11782297795d75e397c58c9da5b03d87feb4eabc6d18cd2c3dace3ead4e65725
MD5 8e754149df0e9b6c5f5ddad3e8efb97f
SHA1 4dd6210c2a9266233cba3af1fa431c7bc6f9a78d
SHA512 02e9e18372fc2395afd7b084c30d678f131e600d02707e22673bc890080aba029c10ff173e96ba5a1f95a3feb578e865edeab35824fb98055a6657a9d5eb27fd
TLSH
T141D02B50826E83520814D83B4D3A1A09C3524DA1128C1F0347324BEFB14082EF2A170C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-1-0x0000000012120000-0x000000001212D000-memory.dmp

Download

memory/1216-15-0x0000000012120000-0x000000001212D000-memory.dmp