c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe
Size 92KB
Sample260924-mqpfcssfmc
SHA256 c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d
MD5 7d974e1454ad8ceb7da167e466e93d95
SHA1 8076655b9da0874bb183221583eb573e45c5615a
SHA512 d69ad9a12bc4c2e14c1488fa6281bcf57e8a2ed59486eff7614543883378bea961ee255fb6ad5b20fc49cf9f3bcf839002d05ddc92f406a10004fcceca445d01
SSDEEP 1536:KCqlZmQaic/EaqJYg7RpIPPKr6VneCkufvr83yFjrAmzTP0KQQg0hIrm:9Xi42Yg7R6HwdkjrrsVrm
TLSH
T10393D1D2F3FB4032F075EF784C79C2608A3B7E212D38859D79F9A98D5B666906C18316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\face.exe	jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system\face32.dll	jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	cmd.exe
3280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02D83959-FAB9-4FCA-9A14-B71E4C1753F1}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02D83959-FAB9-4FCA-9A14-B71E4C1753F1}\ = "url"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02D83959-FAB9-4FCA-9A14-B71E4C1753F1}\InProcServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02D83959-FAB9-4FCA-9A14-B71E4C1753F1}\InProcServer32\ = "C:\\Windows\\system\\face32.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02D83959-FAB9-4FCA-9A14-B71E4C1753F1}\InProcServer32\ThreadingModel = "Apartment"	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4332	regedit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3280	4228	jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe	89
PID 4228 wrote to memory of 3292	4228	jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe	90
PID 3280 wrote to memory of 4332	3280	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\reg.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s C:\Users\Admin\AppData\Local\Temp\bat.reg
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Runs .reg file with regedit
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c17a3c83a842951f47dd290622235e4190d8a4b5a48c4985f8c89af08385ea3d.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bat.reg

Path C:\Users\Admin\AppData\Local\Temp\bat.reg
Size 403B
SHA256 40135ae6eff9255bf8d1b2961b11767e0c929a43ddd100ff88e8b1a55ac5914a
MD5 15c1203e7d472d6f897f828684f7682e
SHA1 2af30dc81c6059c56f33d0669a4fdc3fb61948cb
SHA512 6c01ff34365a0b4104c42ee66439ce27c84318951aa4365b1a8636dc631689f019f8abc099d15a1d066b6f3c0c2e8ff3219dcad75f582911bd217fe8bc2b7a8e
TLSH
T133E02B284D136502D3D0B504130064901FA9567D317BCE54A0C4A37F29B67C2DDF91EA
MD5 SHA1 SHA512 TLSH

Submit Download

reg.bat

Path C:\Users\Admin\AppData\Local\Temp\reg.bat
Size 120B
SHA256 e13c1f03163c10a47171fabf9a59d80dbf706d7f0970345dc1bffd1cd30bc87a
MD5 0c6ef591c17de2f53026416007ec3027
SHA1 c0b9226629c964a1a305aa2cd503f4a9e7adfa6c
SHA512 2a32782b9f843c74fd9d7a37da06f27c85ac9dea53654a6e105deffa47a0ce9d309303abab6fe9a023e04b237d69bf7afe9c9ad3557d3f0e2ca4f3625525d06d
TLSH
T17CB09B4149C687692C0454270D6A954CE06C4CC93ED57B34575AA85C114141DE9C5611
MD5 SHA1 SHA512 TLSH