46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe
Size 90KB
Sample260925-wt7wjsty6p
SHA256 46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3
MD5 0c0305e1e6cc4518b38bf2659192c05b
SHA1 88c80d1073ca4c0138c004f5d9dfd19cf757d6f8
SHA512 93f2879dca7252c33c6d17a65a5f67604193c49ae057d350dc6ccf16745b6c8993d8d54a3e88fd152ecf0ce337490ab9066229457183b0d425b2513a74b4ad62
SSDEEP 1536:LGt08hxPupDgmJfItoQKrH+zJrgNKGEgkQOhpPWs4ZrYh:L+08KVg4ItwH0GEgkQOhpPWs4ZrYh
TLSH
T1C8935C51F68084B7D0550DBD8C9FD2B9A97E7A302D2A5887FAEA5F0CCD7C281261C2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5016	System64.exe

Loads dropped DLL 2 IoCs

pid	Process
5016	System64.exe
5016	System64.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KMe.bat	System64.exe
File opened for modification	C:\Windows\SysWOW64\KMe.bat	jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe
File created	C:\Windows\SysWOW64\System64.exe	jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe
File opened for modification	C:\Windows\SysWOW64\System64.exe	jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe
File created	C:\Windows\SysWOW64\System64.exe	System64.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5016 set thread context of 5024	5016	System64.exe	88

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
4616	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1776	5024	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	System64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2872	5016	System64.exe	87
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 5016 wrote to memory of 5024	5016	System64.exe	88
PID 3468 wrote to memory of 4616	3468	jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4616

C:\Windows\SysWOW64\System64.exe
C:\Windows\SysWOW64\System64.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\KMe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2872
- C:\Windows\SysWOW64\userinit.exe
  "C:\Windows\system32\userinit.exe"
  2⤵
  PID:5024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 12
    3⤵
    - Program crash
    PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KMe.bat

Path C:\Windows\SysWOW64\KMe.bat
Size 276B
SHA256 014f9c41dba6c2e4eef32953da70fc1f7dee2ef448078b19d89a85db7c76c1c1
MD5 e88b35aca1f603bee3228ab924c77419
SHA1 dafdacc2a562aeeb9367c2d276cb34ac2d7374da
SHA512 a1fb5c216d315e0d60623456ccb765d0cd0195d285378e69621fea8445e6ab520adab1fcd2a1969104d18db39a2fa39040d003b7a1e9b579359e3104cec0e071
TLSH
T1D3D02B9055BF82BA3D15C83F8DB94BCDC9424E5D73C80A940353D0F4036053DB6E3590
MD5 SHA1 SHA512 TLSH

Submit Download

System64.exe

Path C:\Windows\SysWOW64\System64.exe
Size 90KB
SHA256 46e87283ddbda3c73b076189596cd200da2f22dff020aaef85cfd2c9cc02a3c3
MD5 0c0305e1e6cc4518b38bf2659192c05b
SHA1 88c80d1073ca4c0138c004f5d9dfd19cf757d6f8
SHA512 93f2879dca7252c33c6d17a65a5f67604193c49ae057d350dc6ccf16745b6c8993d8d54a3e88fd152ecf0ce337490ab9066229457183b0d425b2513a74b4ad62
SSDEEP 1536:LGt08hxPupDgmJfItoQKrH+zJrgNKGEgkQOhpPWs4ZrYh:L+08KVg4ItwH0GEgkQOhpPWs4ZrYh
TLSH
T1C8935C51F68084B7D0550DBD8C9FD2B9A97E7A302D2A5887FAEA5F0CCD7C281261C2D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3468-20-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5016-16-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5024-12-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5024-14-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5024-10-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5024-8-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/5024-7-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads