eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe
Size 14KB
Sample260924-ebskgazz7k
SHA256 eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5
MD5 687e27d84a3f44bf63aa3e47042d4b0d
SHA1 b6eea539e2c82393b77f61cb389c22428e5a3de5
SHA512 3a31b5c22e5b2ba7057db66a1d97b34c880c6e34639dcdd493e27dd78beb92abf1b23cbc44294a86a9797f242124e304b68bbf88e5ac3b2a4ab4e25511d7e9de
SSDEEP 384:nQnXZg4yTke0EjCc2ZGzXa8j3cC1aUnPheHG:n8ZNyTB0dZwzq8LTVnYG
TLSH
T1F0624BDFAFD98BF0FC22D9B255BD721E4ABA6224135C55F387541C29D81A2C0993C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery execution spyware

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\L = 87605860a19960586048999a48618f60576199605e6048999a5856585c535f48618f605761a326000000	jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 5704	1752	jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_eaf228226d7cece7a96695088c0ab2fa6bbd727d627058d939e1a554381ff9c5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\d.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d.bat

Path C:\Users\Admin\AppData\Local\Temp\d.bat
Size 315B
SHA256 99e85d96a0e959e61bbdf48d374b3e90d8090ab6d4f19f22344f2b619960dc03
MD5 f5aa2b701cdab1e5e6a387ab2bde7406
SHA1 68807ab668a3c2cfbda953998f6a944a763c6bd6
SHA512 c8f3b29870beb92cfb5a4d9f9f92e2d11c0553ad3ffce1e9c9b336eb0560360c6cf97458d2e04203c07c8e473430757758c680d303467aa73b7e6d94292101aa
TLSH
T18EE08682018AC55D4842D267E76BD60D845B9E7C3E882B134729C198266341DA9C278B
MD5 SHA1 SHA512 TLSH

Submit Download