98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe
Size 46KB
Sample260924-e62rmaywhs
SHA256 98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65
MD5 a477a0fd8cd9a86f88768f2917fa7146
SHA1 dc5c2bc43a8083db2c0737b7f6bf36164a09570b
SHA512 eec9921f8307cbf0c867cfe4de3012167cfa6f2b1ace5e9f6dcba5e3d770257ffff4340e765b4094734abd002661332e2f9e9592c973d66af5b659d9a15115c6
SSDEEP 768:KnTBMt3qTnsA/wL9JLlb7q6VGh5GVHI5TNjuiWhbbum/fRz0BipG8TorMCKl0p6u:aCdksA/wL9JLlb7q6VGnGVHI5TNjuiWs
TLSH
T17C2319395E9051B6E48055F3606433B1E27B5F3008A5AEA2D7F51C3D19F1CEAEB08BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	compmgmt.exe

Executes dropped EXE 1 IoCs

pid	Process
3416	compmgmt.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\compmgmt.exe	jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	compmgmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	3416	compmgmt.exe
Token: SeRestorePrivilege	3416	compmgmt.exe
Token: SeBackupPrivilege	3416	compmgmt.exe
Token: SeRestorePrivilege	3416	compmgmt.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 3416	1624	jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe	89
PID 1624 wrote to memory of 2632	1624	jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\compmgmt.exe
  "C:\Windows\system32\compmgmt.exe"
  2⤵
  - Adds policy Run key to start application
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\RUNJUSTONCE.BAT
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RUNJUSTONCE.BAT

Path C:\Users\Admin\AppData\Local\Temp\RUNJUSTONCE.BAT
Size 301B
SHA256 d6928ff6f08d735c6bcd0d711f6a30ddba94c96a1271edc9da3aac874753c790
MD5 0acd4accb18b182a41a3151316adde20
SHA1 351543014e2b3125531dea835713c9161cb91efb
SHA512 c47ba7f088bed925a0a55745e71e6137daeaba07aff30e663e923af2188926050eae9710497f905e3b2d6ce08457573a4652c5a6384095ec37d1925db66431a2
TLSH
T1FCE07D05216A4C811C28B49B23B0654AF0300ED329E91F8F1B37C089026206FE44D70D
MD5 SHA1 SHA512 TLSH

Submit Download

compmgmt.exe

Path C:\Windows\SysWOW64\compmgmt.exe
Size 46KB
SHA256 98d204f008c413cb0a3f5355f50fc18b2680e390194fa749de63a247f4f46f65
MD5 a477a0fd8cd9a86f88768f2917fa7146
SHA1 dc5c2bc43a8083db2c0737b7f6bf36164a09570b
SHA512 eec9921f8307cbf0c867cfe4de3012167cfa6f2b1ace5e9f6dcba5e3d770257ffff4340e765b4094734abd002661332e2f9e9592c973d66af5b659d9a15115c6
SSDEEP 768:KnTBMt3qTnsA/wL9JLlb7q6VGh5GVHI5TNjuiWhbbum/fRz0BipG8TorMCKl0p6u:aCdksA/wL9JLlb7q6VGnGVHI5TNjuiWs
TLSH
T17C2319395E9051B6E48055F3606433B1E27B5F3008A5AEA2D7F51C3D19F1CEAEB08BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1624-1-0x000000000040C000-0x000000000040D000-memory.dmp

Download

memory/1624-6-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3416-8-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads