fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe
Size 9KB
Sample260924-elfnnade95
SHA256 fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6
MD5 167436ad537ce8e702c4f10ea7b41f02
SHA1 8c42cf75967ada4f206b5c12903a64b58fce48e2
SHA512 2004cbb98ca228a23699d452f9d60e936d02684fe0d540aa4d3425116c29b30dcb61d80a7341e059ed0a06330d12972153cc50130f4e43a01e79be43385c18a8
SSDEEP 192:4Av+eZlzrfrH0C2823c1iXjMmSFd1NvnJKZBXKyE1GlJuXe:jmerf03c1iXYmSPvncXKLA+O
TLSH
T11312C70F7AC249F1E8E149B10475667DEA709214B720E9C7CB208E2A39B37D3FB7455A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\osQXebgdZClhCoS.dll	jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 6116	5656	jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fd2e67882941d6bb24711cf389f718ed7a486f3eabb37720579587ebdee7b2f6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Del.Bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Del.Bat

Path C:\Users\Admin\AppData\Local\Temp\Del.Bat
Size 192B
SHA256 71afff2fd5b697352f5c089b7f54f622c685d4656be9d40271f5e32d698291ce
MD5 ea7d18424bd363e7be681f4acdfb65a6
SHA1 842033433848e718164aec5de59a593c1041035b
SHA512 87ce45ec7f632b78529aa8ba2eb1fe465304d73d100e67782ea76bc9078f9ab7a1b63317f02c16a7cd523673cd85220f1aa3eae43e6009999d9c1933e04fe15c
TLSH
T134C02201C1E5DA0E08D0262702E88A0EC050947E37CA1B15E224584831C300DD5DAF40
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5656-0-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/5656-4-0x0000000000400000-0x0000000000406000-memory.dmp