f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
Size 2.0MB
Sample260925-vs87jssald
SHA256 f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c
MD5 5a0bc80170171e6654e2d321d9fabc35
SHA1 19141dfc753a048aa54529605bf2f853e4a5af4a
SHA512 dbb9de74558fc39b5b97b578a1b1b42f4f1aca9f8a250a8e9de258b762b2165accc1b85a94c962597cebbe9d5d1cac7670e4dedbd06c994fcc684382daa19dbd
SSDEEP 49152:LawlZLKSZWLy7GfS/5tu4fcNw/0enauzYMlvB:L1ZOS2RenaukMl
TLSH
T155A55C036687503BD1221F364C7B865468FBF9103E15AB4B2FE4FE0DCE39A419D3AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msb_setup.exe	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2788	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1904	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
1904	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
1904	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
1904	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2788	1904	jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe	88
PID 2788 wrote to memory of 3988	2788	cmd.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f78f6133273e0d0146440ae90bedb1c0d79f0a6331b61fc4c00e0b8aebe5575c.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\caa1$$x$$.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -R "C:\Users\Admin\AppData\Local\Temp\caa1$$x$$.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caa1$$x$$.bat

Path C:\Users\Admin\AppData\Local\Temp\caa1$$x$$.bat
Size 391B
SHA256 9756f2053179fcff54756397a65f3d1cdb4bb92f256fb668895d4ca95573269e
MD5 2d0bca94e5f53105c873126ed6fc9626
SHA1 bc3c701b7b0130bd23c6072bc43f3d6b59168adb
SHA512 cd82e0b86ca360f309b2ce60bdf7fe2fece3f4887bc27577d78410e2554f194254716d4b16535fce64c883863d51d2ce9e7f098d480f24eef533649e57edb82e
TLSH
T171E061044397CB1F4C81952F473A174ED0760C5F2F892B01DE32C04D234541DF982307
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1904-0-0x00000000005AC000-0x00000000005AD000-memory.dmp

Download

memory/1904-1-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1904-2-0x0000000000400000-0x0000000000616000-memory.dmp

Download

memory/1904-8-0x0000000000400000-0x0000000000616000-memory.dmp

Download