92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe
Size 37KB
Sample260925-xbpspatfrb
SHA256 92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f
MD5 41a301b3ac34d4cb59f7fd853bc709d6
SHA1 f8ae461a3bc4a90adfdbac11a44342390c5a5744
SHA512 061eeb79f7a2c06f2c1eafeed128e909fbf457fd1994ec1609b597b274487ab80d7f5023bb157043280561fc7091fa44ebf47d1f80ad012da10679495c96d5ee
SSDEEP 768:OgWWqlsoeQLX/mSpm+Psw68EWoe8hg7Mr08WPN:OjWql2QLX/vhB6rLcES
TLSH
T138035C59DAD2C87AC151C5BC8C1DC239EA3736312D3C54D2FAEE1ECDA99A3C1256C286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3652 set thread context of 2960	3652	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe	88

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3416	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	2960	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 2960	3652	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe	88
PID 3652 wrote to memory of 2960	3652	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe	88
PID 3652 wrote to memory of 3416	3652	jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_92f3eb18febf461126ca39a9dd47f7aeb2600075c61ed24e407961d43de4b46f.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 16
    3⤵
    - Program crash
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2960 -ip 2960
1⤵
PID:5244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Deleteme.bat

Path C:\Windows\SysWOW64\Deleteme.bat
Size 276B
SHA256 ec01e26e7cf688f34451deff9dab768b5633bd2c096f69af825765f1bb01a113
MD5 94d4f926fd0b3779e7dbe24cd2b0c17b
SHA1 863f5d33b83c678adca15ab5029af5386aa105b7
SHA512 84a1cb5cde9ab55171695a5a8e787d18ce7483d5bda9bfe3462f8622f2c218ca8e72e5d04bb466a70e578a640972d14cac0d55376e353ee3d64232c703a2014f
TLSH
T144D02B44B197DD056C04C57F08781DCEA1B13F8A3BCE2A2A8B76C4C84260848E5C3FC6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2960-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3652-4-0x0000000000400000-0x0000000000410000-memory.dmp