6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424

Analysis

max time kernel
2s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
Size 34KB
Sample260925-wm3y1sshja
SHA256 6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424
MD5 55f31d014314182929c0e4dc41d59e80
SHA1 43e0e6910bde661bec92f63daf34961c14ff52aa
SHA512 68c3794068a59c67dd5fd29fb67a3fec00fa74e9f18c977b2a821d89e7978fcd8afd7adbb08eba537bdbfc8feecc251ee65f6f1bb8cfc36d27f967b302c29ea0
SSDEEP 768:Jj+0sKqhGPNRkhfyZoQID/4QwEJ8fZsyCZ+ZSED:6HhGw0i/4QHu9L
TLSH
T155F2399B6F088AF3D2DC0634745E4F3A2D7F483929941492CF336EF528BA5D6E424306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5248	fmsbbqi.exe

Loads dropped DLL 2 IoCs

pid	Process
5948	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
5248	fmsbbqi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fmsbbqi = "C:\\Windows\\fmsbbqi.exe"	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fmsbbqi.dll	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
File created	C:\Windows\SysWOW64\fmsbbqi.dll	fmsbbqi.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\fmsbbqi.exe	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fmsbbqi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5948	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
5948	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
5248	fmsbbqi.exe
5248	fmsbbqi.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5948	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
5248	fmsbbqi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 2288	5948	jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe	80
PID 5248 wrote to memory of 2288	5248	fmsbbqi.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2288
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5948

C:\Windows\fmsbbqi.exe
C:\Windows\fmsbbqi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fmsbbqi.dll

Path C:\Windows\SysWOW64\fmsbbqi.dll
Size 28KB
SHA256 d5e78edc7e900470dd0b05a70f6dcc9f237bdef1be2f98200f59efdb7de292ba
MD5 35874c6f0bfb87f2426b74eb3033c790
SHA1 d7e8d18a7f4a3b7225ec6d22f33b69c2be5f9295
SHA512 3fa2cf7fce42498aeeb9da4ba38d4ec6a703977c7ea908137910888856c24e04ed72b1acfbe001b388e3ef1f80af763bf21abd558be5f88f902fee00c472dbfd
SSDEEP 768:zhGPNRkhfyZoQID/4QwEJ8fZsyCZ+ZSED:zhGw0i/4QHu9L
TLSH
T19CD2296A5B188AF7E6DC0575706E4F3A3D7F483868D41493CF336EF5287A1D6E42420A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fmsbbqi.exe

Path C:\Windows\fmsbbqi.exe
Size 34KB
SHA256 6b6b3609851ef3a549245b6b487b72dd8289d2cf82ec77d2ae61315a61ee5424
MD5 55f31d014314182929c0e4dc41d59e80
SHA1 43e0e6910bde661bec92f63daf34961c14ff52aa
SHA512 68c3794068a59c67dd5fd29fb67a3fec00fa74e9f18c977b2a821d89e7978fcd8afd7adbb08eba537bdbfc8feecc251ee65f6f1bb8cfc36d27f967b302c29ea0
SSDEEP 768:Jj+0sKqhGPNRkhfyZoQID/4QwEJ8fZsyCZ+ZSED:6HhGw0i/4QHu9L
TLSH
T155F2399B6F088AF3D2DC0634745E4F3A2D7F483929941492CF336EF528BA5D6E424306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5248-10-0x0000000010000000-0x000000001000D000-memory.dmp

Download