2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126

Analysis

max time kernel
135s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
Size 109KB
Sample260924-mpf3labe73
SHA256 2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126
MD5 8d5a6ee0092218e59540f5b3a3403931
SHA1 9a07fc3458e62681a04f205e28d5de0318caf0ff
SHA512 339c2e1e32e7ed3f0950be46504e2ee8c973abeaaa08f015f17340d7b51b568c0e92bfd8cac5d983a249c1dd570b872ff6edf77ed16e3cb82791c4acd221bd26
SSDEEP 3072:9Vb4HkE6NnP+jRaOvjcSJvLr9h6kx6+in6Xz7OXB1:9t4ZYecSJjr9FxLu
TLSH
T165B36D03E7D18432E0A18AFC4C2AE264EE3B3E712DA9541AB7951ECF5D3C2914C69767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
4636	exp1orer.exe
4652	exp1orer.exe
2776	exp1orer.exe
5136	exp1orer.exe
2240	exp1orer.exe
2932	exp1orer.exe

Drops file in System32 directory 39 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inetapi32.dll	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exe	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1360	cmd.exe
2968	cmd.exe
6032	cmd.exe
5368	cmd.exe
4900	cmd.exe
716	cmd.exe
4736	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4636	5028	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe	89
PID 5028 wrote to memory of 1360	5028	jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe	90
PID 4636 wrote to memory of 4652	4636	exp1orer.exe	93
PID 4636 wrote to memory of 2968	4636	exp1orer.exe	94
PID 4652 wrote to memory of 2776	4652	exp1orer.exe	96
PID 4652 wrote to memory of 6032	4652	exp1orer.exe	97
PID 2776 wrote to memory of 5136	2776	exp1orer.exe	99
PID 2776 wrote to memory of 5368	2776	exp1orer.exe	100
PID 5136 wrote to memory of 2240	5136	exp1orer.exe	102
PID 5136 wrote to memory of 4900	5136	exp1orer.exe	103
PID 2240 wrote to memory of 2932	2240	exp1orer.exe	105
PID 2240 wrote to memory of 716	2240	exp1orer.exe	106

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5136
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        Executes a command shell one-liner
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:716
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5368
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$336699.bat

Path C:\Users\Admin\AppData\Local\Temp\$$336699.bat
Size 323B
SHA256 7d833ef7d5765468f68f5220e24a247da6a969d8d115351e3043df217dd28611
MD5 b05847f48af611287053aaa2f40c114f
SHA1 85d0dccfa72d4ce05e1bedd66153ed82ba67054c
SHA512 85df3aeb150f082fde7f74ca5c55f15b29ca3322d8851b1d9d617ba1692d9c2a732ac71d77d27f60620685ee0e4e1da3296ae3b6bcd08df82a50f8f60e873f63
TLSH
T15EE0869252A3CA97A814D15F47B5768D90621DD57F8D2F11A730CBCC56D280CB585A41
MD5 SHA1 SHA512 TLSH

Submit Download

$$336699.bat

Path C:\Windows\SysWOW64\$$336699.bat
Size 141B
SHA256 78bc6789011bd5919846d8e73b8ed38f98db725ad4c2dc9c17b69b4b42002e9d
MD5 987ba00b6747c361e2b30b5e1f6d7299
SHA1 8fa61801da6fdeb3ed5823de3374fd642c395865
SHA512 0c5cb2251f3a3dd72b0314b35ecb7e6ecbc357bdb1283bf21595565526c3b4fac091becedc79387de2c438d05cb57dbafe14b32949015547832316ce53579f6e
TLSH
T1CAC092D0A07640C1F0A0B9094B0E1685D30BF2F3B048393320A902ADF86241A8FDAF8B
MD5 SHA1 SHA512 TLSH

Submit Download

exp1orer.exe

Path C:\Windows\SysWOW64\exp1orer.exe
Size 109KB
SHA256 2fd2ba1406205f3a8e3d8641783a031ef0074ee55effc7b525a281894625f126
MD5 8d5a6ee0092218e59540f5b3a3403931
SHA1 9a07fc3458e62681a04f205e28d5de0318caf0ff
SHA512 339c2e1e32e7ed3f0950be46504e2ee8c973abeaaa08f015f17340d7b51b568c0e92bfd8cac5d983a249c1dd570b872ff6edf77ed16e3cb82791c4acd221bd26
SSDEEP 3072:9Vb4HkE6NnP+jRaOvjcSJvLr9h6kx6+in6Xz7OXB1:9t4ZYecSJjr9FxLu
TLSH
T165B36D03E7D18432E0A18AFC4C2AE264EE3B3E712DA9541AB7951ECF5D3C2914C69767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetapi32.dll

Path C:\Windows\SysWOW64\inetapi32.dll
Size 46KB
SHA256 b5b0bd9481049497d03bf61ebbd5978dca5a9df8486b295c487cfc3fded09c28
MD5 bb7c1068f8e8cbcae2877bd3e9559e6b
SHA1 bc694b25ee15d5250bc7bf461cfcbfd237022b0d
SHA512 73184996d1022b7e87911215156c24bb249c4d323fb131a35cd51a2ba1982d2c9cd13b128c6670b0fbc502305821b4f3ca00cc5193a99b05906c79f243500076
SSDEEP 768:+u1qWcSJvszmNj1w0SOAVcH3xu0fEVw5MLO1hykFZx6qjrRt4HHwTXz:V1qWcSJvsErJH3C2tgkx6+in6Xz
TLSH
T11F237C03A7E18431D4219AFC4D25E2B8EE3B3FB52CA81419AB610FDF58353A15C6972F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2240-65-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2240-57-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2776-34-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2776-35-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2776-43-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2932-76-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2932-68-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2932-67-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4636-22-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4636-13-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4652-24-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4652-32-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5028-11-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5028-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5136-54-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5136-45-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads