acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
Size 31KB
Sample260925-xerrfsgh89
SHA256 acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09
MD5 7919df104dc12cf93f5b8c1c12ce6449
SHA1 b986ad50bfbe99786b3120710eef7f152f6f4a29
SHA512 19e5c740e857d42dec751ad6c2c3db36245099cc90225fb498fee192a54e0c71bfc7c68be8197a22285a1347c3ac8f54700ad1d8305547c564ccad6edee2ae98
SSDEEP 768:Ot1B8CQdWNBpvYE+pmZv0dmRVWyDVONF6A:K85x6QkVO3
TLSH
T11FE25B061A1940F3C2BE063470055F3B5EBE8C786A957467CF738AD6ACA53D3A53870B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1096	cmdbcs.exe

Loads dropped DLL 2 IoCs

pid	Process
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
1096	cmdbcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cmdbcs = "C:\\Windows\\cmdbcs.exe"	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cmdbcs.dll	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
File created	C:\Windows\SysWOW64\cmdbcs.dll	cmdbcs.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\cmdbcs.exe	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmdbcs.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
1096	cmdbcs.exe
1096	cmdbcs.exe
1096	cmdbcs.exe
1096	cmdbcs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
1096	cmdbcs.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 2576	6128	jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe	81
PID 1096 wrote to memory of 2576	1096	cmdbcs.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2576
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:6128

C:\Windows\cmdbcs.exe
C:\Windows\cmdbcs.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmdbcs.dll

Path C:\Windows\SysWOW64\cmdbcs.dll
Size 23KB
SHA256 81def3dd747a6f5364ce6689bf99259702082dcab7a64fe773e48596994b552d
MD5 f9f83c91ecabe3ac2402d8b2b9c12fb8
SHA1 5ab67f6518a40c0c3be6b9e8b340a0e94decacef
SHA512 46528bba83c4549b0790a517d4762320785e70cde4f28ee3a737eb1ddb4c2165fee087f38e0f75891bd5e95bf090d7af84ca68449f0d16a0aebefb600cdf3cd4
SSDEEP 384:U4wXWWw1vY+MPirwhzlrHmZKe0zxKffRVtgyDe2MkOaUF6uh:/BpvYE+pmZv0dmRVWyDVONF6A
TLSH
T1E3B25B16421580F3E6BA0238B05A1F371E7ECCB86D957917CF375AA56CA63D3A53830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdbcs.exe

Path C:\Windows\cmdbcs.exe
Size 31KB
SHA256 acb50f32606efc96123a08c7465e43ab5fd12336e55a8450a5350555383d7b09
MD5 7919df104dc12cf93f5b8c1c12ce6449
SHA1 b986ad50bfbe99786b3120710eef7f152f6f4a29
SHA512 19e5c740e857d42dec751ad6c2c3db36245099cc90225fb498fee192a54e0c71bfc7c68be8197a22285a1347c3ac8f54700ad1d8305547c564ccad6edee2ae98
SSDEEP 768:Ot1B8CQdWNBpvYE+pmZv0dmRVWyDVONF6A:K85x6QkVO3
TLSH
T11FE25B061A1940F3C2BE063470055F3B5EBE8C786A957467CF738AD6ACA53D3A53870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-10-0x0000000010000000-0x000000001000A000-memory.dmp

Download