7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe
Size 14KB
Sample260924-ebvd3ayvbv
SHA256 7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd
MD5 c91e6070178c44c8e4fffbc343c75b14
SHA1 d7f54f42ae23359b8b0b39c7b43038e5dcd7b100
SHA512 2ff0b2f2f34624f101e65ac893c09f0985cebe5689bd5ab5296ac3527b0982664e247b85b306cdef8564707abbd96aced0b6f8e9572eae420ceabe205b3b23df
SSDEEP 384:nQnXZg4yTke0EjCc2ZGzXa8j3cC1aUnPheHo:n8ZNyTB0dZwzq8LTVnYo
TLSH
T12C624CDFAFD98BF0EC22D9B255BD721E4EBA6224135C55F387541C29D81A2C0993C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery execution spyware

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\L = 87605860a19960586048999a48618f60576199605e6048999a5856585c535f48618f605761a326000000	jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
812	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5800	4656	jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7322a00afe6a4a3ddbe67b69e368142f22025cf9b6808058da596a5472190ebd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\d.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d.bat

Path C:\Users\Admin\AppData\Local\Temp\d.bat
Size 315B
SHA256 bb39b6f88ba9c9c974ccf023fda1cdddb2a490fad195f13c27bec5bb316443c0
MD5 5e9d22735564a338aaee11f77dbfc49a
SHA1 b0fd758f93f2b386b215375dd3ff4e8ebe2d9633
SHA512 8585620f31b5e41ad251b9f728e2c4bbc6610f6066f1d78679193132ecd8245ab68169250795b90db0620bf2465a377ea53afd32c7a7efba95dd1a7dbc41001b
TLSH
T1BEE0868151D5959C0858536B0B756AAFA16F0D9E19CC3F12A73186891FE241CB8C6738
MD5 SHA1 SHA512 TLSH

Submit Download