71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe
Size 14KB
Sample260924-ka77eshf37
SHA256 71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc
MD5 7fb4da9a5c4ab9bdf5a50098098fbfb4
SHA1 6680cb1819267ea36069e16c312feed9baefc55e
SHA512 f5cde23253e54747bdfe4a5aa6f2dd9b0e9b91c0d114102e4a6b37e21da4e33efc008e344085f40227122b2be977b2e41fbc1499361091d88d7e6f9d8a91017e
SSDEEP 192:tFaR5Fhp8cdwpHR3AkPLiM79mLU2PcUOhcum:DU5FZdgAkTiM79mgLUccum
TLSH
T139624F0FFD42D998D2C156B0D969453AD6498B89032F138FBB88BC163FBD279C578A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4588	b2e.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2532	cmd.exe
3500	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4588	1192	jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe	88
PID 4588 wrote to memory of 3500	4588	b2e.exe	89
PID 4588 wrote to memory of 2532	4588	b2e.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\A56E.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\A56E.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\A56E.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_71ab610a67826e6ff4999e1e03bb7d9f87d79d668ca60b831febcfa0f76fa2dc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A771.tmp\batchfile.bat" "
    3⤵
    - Enumerates connected drives
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b2e.exe

Path C:\Users\Admin\AppData\Local\Temp\A56E.tmp\b2e.exe
Size 8KB
SHA256 00a7e04ce278f00b371746b4e73ac78fa8301dffe0e149e6629f1d82170e4643
MD5 5f20224954b5e2aec379030f26462b0d
SHA1 a9840da77a1a86bf481e0be267e594938ffe8def
SHA512 878029e660b7e817dbf55104bb2c6a0418a59e928405d9621fb32e59f041dba7469bd685128d1f3f377515d6e5ee9bdfeea6d0b722825a311e5818123b8a8927
SSDEEP 96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcUK:3R5Fhp8cdwpHR3AkPLiM79mLU2PcUK
TLSH
T12102410FF9904AA5C3C0C5F41AAD42B9DA5143CE837D518BFBDC8C262BB96B1E47961C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

batchfile.bat

Path C:\Users\Admin\AppData\Local\Temp\A771.tmp\batchfile.bat
Size 150B
SHA256 a623bc5ce4fd2c139c374ad5a311b4833b7fa22ae49ee266d81404f65488fbe3
MD5 4c04845de03bc8d9fb6215e477ee3de4
SHA1 2c1c85b6848340cad75ca80f5f1c3c88d2d626d1
SHA512 c11e1c70b1e166eec881a5cc4917a92d6e300dc7eaccaafea08895ab6c989ddbfb2ce8b35a6f0b27463f2371410fe6fd5eb6068ea90fab18ecf6f4a621362502
TLSH
T16BC08C49F6860222F0E84B30E800C580B1EA60108E93B5B703AC002C8D0BD888F16218
MD5 SHA1 SHA512 TLSH

Submit Download

selfdel0.bat

Path C:\Users\Admin\AppData\Local\Temp\selfdel0.bat
Size 158B
SHA256 af2d80d3202fd9b97c2e1a1bfe661bb28c5b7bbd1c8a5ed4e75a05bb1f7ea0c8
MD5 8eb66b7bde1c95d86e84a71d59f7599d
SHA1 c1eacf7d886e64b4e843b56be112a74ef26083a9
SHA512 507b31ddb1d2331fd9a8173013d45969d42465cd98e3dbbbbc9c2c907374cae73e9ea75cb406601d1af4c3804d9ed24fc3a63605cbf3f59d698cfaba9ae3a1d4
TLSH
T1CBC002008ADBDB5E250590A706B6EB8CA0B51D083E8A3BE08B6A880C154280EBA82202
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1192-0-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/1192-13-0x0000000000400000-0x0000000000407000-memory.dmp

Download

memory/4588-9-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4588-28-0x0000000000400000-0x0000000000405000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads