e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
Size 31KB
Sample260925-xdsblaxvft
SHA256 e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3
MD5 5d7de9f6944eec1f7d075c2a64afd547
SHA1 0afdd576c24fed5fe5dc17830aae097e438aa6a9
SHA512 439d0adae0344571bf6e24936ea62df8bd4a62bfed35cb3556c9600b3e25b8eb880a744dfb24717490cb08f1da69c1221abb53d4b15e94ec3c10d0dfcc76b18a
SSDEEP 768:6ObFenxU7hLsdOKEKeK9KKKeKAKmK7KYIZmVjUMDylT+HnIF58:ryq7hLq9LN4pNXVusjUYi8
TLSH
T109E25C064A1980F2D5BE423074055F3B4FFE88786A94B5A7D7334BE5ACF52E3A538217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
956	cmdbcs.exe

Loads dropped DLL 2 IoCs

pid	Process
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
956	cmdbcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cmdbcs = "C:\\Windows\\cmdbcs.exe"	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cmdbcs.dll	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
File created	C:\Windows\SysWOW64\cmdbcs.dll	cmdbcs.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\cmdbcs.exe	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmdbcs.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
956	cmdbcs.exe
956	cmdbcs.exe
956	cmdbcs.exe
956	cmdbcs.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
Token: SeDebugPrivilege	956	cmdbcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
956	cmdbcs.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 1288	3652	jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe	80
PID 956 wrote to memory of 1288	956	cmdbcs.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3652

C:\Windows\cmdbcs.exe
C:\Windows\cmdbcs.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmdbcs.dll

Path C:\Windows\SysWOW64\cmdbcs.dll
Size 23KB
SHA256 e7cefbaaa430548dcf7f18ed15dc5d7c2f7914eacc9d60240e90c1dd38c8fb45
MD5 3051c96cf11800e292316fb363d2c983
SHA1 2ede31745f96a9aa20212685f1b01bf05ccfba4c
SHA512 d4ee19c8ba85a02608d121f1ddfbca9dfbb0c497aadbcd23a730973498f4b2b71aaaceb436eb09044316b78ca1a7ba036c785e717587cbf2ccc673eeebf62b37
SSDEEP 384:N6/xUXG6AcP7hVZgpdOKEKeK9KKKeKAKmK7Km1t34ZmVjlmTRaDCVKfoTKfHuOPr:sxU7hLsdOKEKeK9KKKeKAKmK7KYIZmVB
TLSH
T195B25B154A19C1F2EABA0330B0051F374EFE88B8BD94B547DB3747E56CA41E3A57821B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdbcs.exe

Path C:\Windows\cmdbcs.exe
Size 31KB
SHA256 e8cf45a607b1c9f0be0dd21e407cef1b23d46aeb0c4dcca90dcf09c8470cdff3
MD5 5d7de9f6944eec1f7d075c2a64afd547
SHA1 0afdd576c24fed5fe5dc17830aae097e438aa6a9
SHA512 439d0adae0344571bf6e24936ea62df8bd4a62bfed35cb3556c9600b3e25b8eb880a744dfb24717490cb08f1da69c1221abb53d4b15e94ec3c10d0dfcc76b18a
SSDEEP 768:6ObFenxU7hLsdOKEKeK9KKKeKAKmK7KYIZmVjUMDylT+HnIF58:ryq7hLq9LN4pNXVusjUYi8
TLSH
T109E25C064A1980F2D5BE423074055F3B4FFE88786A94B5A7D7334BE5ACF52E3A538217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-10-0x0000000010000000-0x000000001000A000-memory.dmp

Download