f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe
Size 14KB
Sample260925-wwj79sty8l
SHA256 f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad
MD5 e9f069a02e189a5888339cb3c2ac0cdb
SHA1 a5a5fbc415a8a74cd49ce92b9dbcd82608ea3d04
SHA512 dc8338c4068f175d65e7032d63ec6ed4a60fc07bb069ee2795a4b9cf043e6530bbef979c6df8fee62dd4b1aef11b0e0064e2e9f8d14ab4aa55d45c7ea08da255
SSDEEP 192:yCHZ1ZFt6XAuqZzqhAh0LLpXYsDoLTnyTno4mo/MOW4:dfu+u6mYTyToVoUX
TLSH
T13D5208131F9808F3E55424B879978F57AF2E713473991CDB8FB32C89AD192E16C3A246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6048	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe
1876	jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 6048	1876	jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f4c84506614012484f7d303cea10b473f9b1822159ca1d00afbae2837ed073ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c c:\test.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

test.bat

Path \??\c:\test.bat
Size 277B
SHA256 cf62bacc4fdb20eeb91ddf842b3a512569568bc99fe8182a997cc9aa64dbf2ac
MD5 b5393662780d620e881628b44e7d550e
SHA1 b3c36ff0726decfb029e61047563797651c807fe
SHA512 28ccf42d8658eb4e7e920403b2c325c90894fbb9e66e0d80b232f5731612ec350db0ba3241bc85937584416f9cec309b7aa187aaec8d6b4efca7c9b53ce5b348
TLSH
T124D02BC453514D471C05E97F87304B9E55351655AAA93F17D612CAA0029D80FF3E368B
MD5 SHA1 SHA512 TLSH

Submit Download