a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe
Size 386KB
Sample260925-2h7dja1vcx
SHA256 a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68
MD5 5067e4ecdeef3189a9f180be04213622
SHA1 662f235874c595ffbd80cdd2e6142d01a3236977
SHA512 ac40ede7eb051871a64e58853a11316a9a6a40fe907a5d58090bc62dc6010a54c66799769877c8758496b1a9d6b63a8154b0562bfe0efea45482a2e38c07727b
SSDEEP 12288:tlRqW9tWsBtGB5W93w0ENG1JSwgxvsSeT:tlsW9tTPGBI9ZEmJfkJeT
TLSH
T196848E22F7C14476D0621A78AC5AEB7D993EBF202D386547B7E82E0D4E3D7C168183D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DRATSer\Parameters\ServiceDll = "C:\\Windows\\system32\\\\System64.dll"	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe

Loads dropped DLL 1 IoCs

pid	Process
4240	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KMe.bat	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe
File created	C:\Windows\SysWOW64\System64.dll	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe
File created	C:\Windows\SysWOW64\System64.dat	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3048	2460	jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_a9674fbac5c7b08e0e9983910d552174ff345b6efcaf4d08a50c7776a6d7fd68.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3048

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netservice
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netservice
1⤵
PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMe.bat

Path C:\Windows\SysWOW64\KMe.bat
Size 132B
SHA256 6746256298de5d2dbf9919d88b7b6ebc32a8ab174e0c1e8993b13489cbfab940
MD5 4e495f1d4fde1d3c3a0f1b5e5879af32
SHA1 3934c924a19a713b1628c91603dadd9c0cd4cbbf
SHA512 7e231cfd253439e0c2ce61552422068ca8019062f32e5b6d1bc9bfa16e50d951ec9a9f05a62fc9a2a97157e1fd95788d8cc0b95cdb201cd50b3f3e75b1e59966
TLSH
T1ABC02B00D3950DC908C8C48B0530228FC0F118351BC41BDC4202884A30F8078B804109
MD5 SHA1 SHA512 TLSH

Submit Download

System64.dat

Path C:\Windows\SysWOW64\System64.dat
Size 69B
SHA256 46cd61849e8b5ffa504b48326bf77f8c136d2d457754b0dc5e2fb23b08d0d01b
MD5 348c5f686cea70bebcdd6e88967786dd
SHA1 f2284fc284fca34edf876cef6576e96f48d6a514
SHA512 afdd5aaa30195f7b1542002fc89b1d044ace12e1f3a747f8fcb4cc7b9bc7137c06d03b6468d0f324a91fb588fe8fd375c8636df8028d6339b598f28a8f5d2028
TLSH
T1A5A0028442D245126C30407457204D005D50AB1204A05E39916E7F447F4FB5990999DF
MD5 SHA1 SHA512 TLSH

Submit Download

system64.dll

Path \??\c:\windows\SysWOW64\system64.dll
Size 289KB
SHA256 564b862da64ce41e384f06f765e7ad0b2d6fd1aa7fdaa784d58a6e92ef65774b
MD5 a295cc386335819c73197fc276fd31ec
SHA1 0ab1931803285affc8a9a586574b1fbae16d4209
SHA512 651e0b8fa9917794a8330ef5768acb3c0446c2339d7c57a9e35b98894faa4f91e2dcd7840381c3d7d885c28e2e18e557f0b5c894883bf5850fb806cd26b3aa81
SSDEEP 6144:6yeig8BYKpWow3w0lia+RGtjjzmNoXoazGw9avowvsSeTBE:6GB5W93w0ENG1JSwgxvsSeT
TLSH
T1BB549D21F7C1447AD0535A389C6AE77A993EBF102D38654BB7E81E0D4E7E3C269183D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2460-6-0x0000000000400000-0x0000000000467000-memory.dmp

Download

memory/4240-10-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4240-12-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4240-18-0x0000000000400000-0x000000000044E000-memory.dmp

Download

memory/4240-20-0x0000000000400000-0x000000000044E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads