04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe
Size 13KB
Sample260924-ej8awsz18r
SHA256 04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0
MD5 350a0e6c581751f49bc451e6ef80ff66
SHA1 105f0ae6793ece733daaeef24dc833ace69a02e1
SHA512 d2a3b4f52902c157ddef8c13c95749465cc57b2df206be772b62855fed298068e4485db384683083a2eef8168b8532b0a857d1813fd8581ac4d7cec3afbc4ab3
SSDEEP 384:uuMkyC7bblL+Os9RjzimixyYMQP1KUuEweEGoj:7M27vlLFsdQP8UGeVG
TLSH
T14452974B96C954E7E6E40274012F73BA8A3B25D0067DBE436F50EDA90477372F63A10E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.exe	jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4260	jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 3128	4260	jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_04cc1bb9b3e3db7dd6a04c43f430cc78763dee0b9d6d33eb0847b48aa47246d0.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads