fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f.exe
Size 1.2MB
Sample260924-hs15qagc95
SHA256 fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f
MD5 ef294b00ebf139830545084e27f7fa82
SHA1 18d082e2b6ee2e881d57d40be124de226f8b8fa1
SHA512 12a823e5b42b0e2cba6647eb154bd04a3e90dd02eb9a91670df9db77e4f47e2e687a9e65579f1c299a17e12b81e2ba86ae56e1a573c4192dd306dfc1f9e3b85c
SSDEEP 24576:XRCzHDOFPNS/i9xKMxHx4C3oA4Dyi80Gkq0hGxlLCxKhCCQcEEF:XofOdQwxKQHx4CYVyxP0w4S9F
TLSH
T15355232A92C084F3ECE2D6B5055F6223E436FD2D6E14E56D5F4A219CCC31A937126B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5428	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
4268	ad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 1660	256	jaffacakes118_fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f.exe	88
PID 1660 wrote to memory of 4268	1660	cmd.exe	90
PID 1660 wrote to memory of 5428	1660	cmd.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5428	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fb4a2584489730bd43b4fc6e95a3ca55fbbe07a4586016a133dee1f2780a858f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Drivers\update\id.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Drivers\update\ad.exe
    C:\Drivers\update\ad.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4268
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Drivers
    3⤵
    - Sets file to hidden
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ad.exe

Path C:\Drivers\update\ad.exe
Size 1.6MB
SHA256 cb67b6eb044be0854e7c2758c9c08a1214e356776b4818b57f58f3146b37e0c9
MD5 5a530495513d2fbc989030adad584821
SHA1 f05cfd7354c34e9c35f1b831ba272ccd8cc07b4f
SHA512 7fc7fb482eba76cb7c63a484fac46caab516caa3d774c91115a302a0638d1d2c2abf82beb6df3ccdc33c7700e0a86408f1699a8db88d535aaa13876f34d101f7
SSDEEP 24576:sVVnkjWbvaHbrAyiWnB5hH7WAqnb9GcqXKAaLY0mR7eRVx1B+Pb+u:AVkjav4gyiWn5H7W9pGxaLAUVuK
TLSH
T14B858E20D501942EF69306B2846DD76A7E18BF34539050CBF3C87DAE62F66E3793660B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.bat

Path C:\Drivers\update\id.bat
Size 74B
SHA256 b9546c9b0cd892ce8ba010ac8a52a40cf92f733ab78d5078a593c573c6e1ed9c
MD5 c9fd73e53b29b495544796564c82427e
SHA1 e8c20838970a579cd8ffccf4612c7f24cca46a74
SHA512 8b53f0a48009cf9535530c78a4028f95b803b658a46c515bce0ee745627fed62d39d091884b0688d4cf300af65ac9dfcd5ef36559bc0a04c2b30a63662f345c8
TLSH
T182A002D5CFE0C83B0A6BBDE0478B155AAB07D0AE8532646153D700E1D48E48E9E4865B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-21-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads