Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe
- Size 59KB
- Sample260924-mtfmmabf67
- SHA256 024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29
- MD5 a41db32560dfb51c51852f2bef77926a
- SHA1 9a485ebfe863282f108a51b74c5af61ac2405445
- SHA512 abfa0df2370915b934e95d3b856238cb7ce245fa22efb86f4be1888a734ab7605893508752fbedfae2849083cdf9b53f7dc549f334faea73bf3b917c82b20284
- SSDEEP 768:iKcbvErcxlka1s61Tq78oawm59e7h9BsAMQ36P4Z:iBdV11a/Q9IsAx6P4Z
- TLSH T1C453BFA3D7404C96D1F3D8F94EDD40D508B86C82CF2B795C95CB5E076CF88AA96312AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5228 go.exe - Loads dropped DLL 4 IoCs
pid Process 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\me.bat jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe File opened for modification C:\Windows\SysWOW64\me.bat attrib.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\MayaBaby\ri.dat jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe File opened for modification C:\Windows\MayaBaby\ri.dat jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe File created C:\Windows\MayaBaby\MayaBabyMain.tmp jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe File created C:\Windows\MayaBaby\ri.dat go.exe File opened for modification C:\Windows\MayaBaby\ri.dat go.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1948 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language go.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe 5228 go.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe Token: SeDebugPrivilege 5228 go.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4476 wrote to memory of 1948 4476 jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe 91 PID 1948 wrote to memory of 4312 1948 cmd.exe 93 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4312 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\me.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\attrib.exeattrib -h -s -r -a C:\Windows\system32\me.bat3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4312
-
-
-
C:\Windows\MayaBaby\go.exeC:\Windows\MayaBaby\go.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\MayaBaby\go.exe
- Size 59KB
- SHA256 024a932b517de8480453291c53c7c75f53e4fc34533487dd167a5bdcaae7dd29
- MD5 a41db32560dfb51c51852f2bef77926a
- SHA1 9a485ebfe863282f108a51b74c5af61ac2405445
- SHA512 abfa0df2370915b934e95d3b856238cb7ce245fa22efb86f4be1888a734ab7605893508752fbedfae2849083cdf9b53f7dc549f334faea73bf3b917c82b20284
- SSDEEP 768:iKcbvErcxlka1s61Tq78oawm59e7h9BsAMQ36P4Z:iBdV11a/Q9IsAx6P4Z
- TLSH T1C453BFA3D7404C96D1F3D8F94EDD40D508B86C82CF2B795C95CB5E076CF88AA96312AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\MayaBaby\ri.dat
- Size 52KB
- SHA256 5b521c45635752b9caf3d30520e7a2689af682ad0f996b93890b1627099b6e29
- MD5 9dfebdffb630929e5f17343c5a4eab4b
- SHA1 35df369c1e989f6b9a193bdfc9a7dc187fbd2cd4
- SHA512 cdeeb8dd99daad10b0bab2a5cd636e5d3ac512c59a02694f088d8437596470e4a8045ee323657df6cd96de5c5a4a72056bc5a38f07685f68756af63703830cd2
- SSDEEP 768:4y8QO4ET1ZjgD/mR4MaCbZMZT6Kno4CEh8Dk:xA4ET1Bg6aCFYNo4r8o
- TLSH T1E2337D327CDA4472C655863205F1673F8A7EA92146E69CC3BBA8C9460D712F3D13ABC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\me.bat
- Size 179B
- SHA256 58b7033faca6e7704ad534bb2061fe9dd7b1475c90af3f4f84206d0ef73b087b
- MD5 fb6a79e0a1612d7c06025d72987163de
- SHA1 1b8376d0c8ee1d035adc8394789d9f533f51bb9d
- SHA512 6953b676a8db11e5a2eb309f44ee0daab3c946f84b0551c0edad4ce9851b90218b9e213b453bba03206fb96349b73c641e2eb7bea97d782235ab457701f36355
- TLSH T131C0C089C70128385C313CDB803E6E0FF0A7556E5E8A0DC8030380FB00D043E180CC02
- MD5 SHA1 SHA512 TLSH