6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe
Size 88KB
Sample260925-2xdd1aydnc
SHA256 6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b
MD5 38d0341f68675b2899a41ae6ae9ef3bd
SHA1 9e25d5fabc2e75440404083bdf3bed659d5bf7c0
SHA512 6cb481798e9fd0e5d4998671283650667982b57f64213ff4a1668cdbf1df8fbb3d9aafa7711c0e860b6e3be7b63f48139a82d054d7dfba698ed3c8b3b3687d5f
SSDEEP 1536:bnt8nrHvXIh8bqUja+vGOZxk8bqUja+3I7/8D:SnK8bPCOZW8bPTI7
TLSH
T1AE93D0126B116F1AE1D50D729AAA01924D7F9401AF053387FBBD68CE2F3D3F5862835B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\smss.exe	jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\smss.exe	smss.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\smss.exe	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2564	smss.exe

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\e:\	smss.exe
\??\f:\	smss.exe
\??\g:\	smss.exe
\??\h:\	smss.exe
\??\i:\	smss.exe
\??\j:\	smss.exe
\??\k:\	smss.exe
\??\d:\	smss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4952	cmd.exe
5300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2564	4168	jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe	88
PID 2564 wrote to memory of 5300	2564	smss.exe	90
PID 4168 wrote to memory of 4952	4168	jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b.exe"
1⤵
- Executes a file named after a Windows system binary
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\smss.exe
  C:\Users\Admin\AppData\Local\Temp\smss.exe arg2
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat" "
    3⤵
    - Executes a file named after a Windows system binary
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gameupdate.bat

Path C:\Users\Admin\AppData\Local\Temp\Gameupdate.bat
Size 295B
SHA256 ad91beb1d9569932aba5a44d50e47a8b8e3b2c2cf2b37df42b496bc1ac18ecfd
MD5 66eb6e2ca59f091a56e75fb91ee6696d
SHA1 9ca867e3d3ba0718a19ff681f47d5d2b97dddeca
SHA512 9d13e6a8f630630992401f0b8894b61ec828915f8e2d5302da431620c5846fac22ff8008e5e275da322de9d1012b5ea25ec2bf6b2c3b5dbc29d6a61ea8213455
TLSH
T126E07D4C405E8D86088898BF0934549DD0616D5A274F2B510B314488218282C78C3B02
MD5 SHA1 SHA512 TLSH

Submit Download

smss.exe

Path C:\Users\Admin\AppData\Local\Temp\smss.exe
Size 88KB
SHA256 6b9fa58734a91de33e1027888b83b058499581938990bc2d03c4f1e36954638b
MD5 38d0341f68675b2899a41ae6ae9ef3bd
SHA1 9e25d5fabc2e75440404083bdf3bed659d5bf7c0
SHA512 6cb481798e9fd0e5d4998671283650667982b57f64213ff4a1668cdbf1df8fbb3d9aafa7711c0e860b6e3be7b63f48139a82d054d7dfba698ed3c8b3b3687d5f
SSDEEP 1536:bnt8nrHvXIh8bqUja+vGOZxk8bqUja+3I7/8D:SnK8bPCOZW8bPTI7
TLSH
T1AE93D0126B116F1AE1D50D729AAA01924D7F9401AF053387FBBD68CE2F3D3F5862835B
MD5 SHA1 SHA512 SSDEEP TLSH