788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe
Size 790KB
Sample260930-lgedcstsf1
SHA256 788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d
MD5 5df801bdaf2a7cbe550b8b49e64ef3d6
SHA1 4c84f4fadd4ea6b9763baba061a5d2fc1ed728d5
SHA512 61041e3bf956687ba29903537f9f60ddcbdcf6e036680301fbaf0103763f835d443b5e4c9797a61d754a2078a56893a8fff1040ec9332a14a235fa7017e91b82
SSDEEP 12288:spqiC/2OGAtkCP4cejGSOpRK3CCEkW9it0OXKRzfG1QAzpT:spo/2+ttPJLfpRK3CC9W97izpT
TLSH
T1D005BF12B7C680B6D8A33D711577D32AEB3979154326C69BEFE02E268E114709F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2632	jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\D:\	jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2632-0-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_788f9eba3b8d9a533d01614f0d73225b050a81b4466cae1f8ad56e846afd196d.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Crypt.dll

Path C:\Users\Admin\AppData\Local\Temp\Crypt.dll
Size 4KB
SHA256 547ab733bd5d60e0bd0e31cb26649a8d5b80e10f2996c9bff21b026dd4494454
MD5 d837210daced01236ccc50baeb996f51
SHA1 2f9dee67b1af7e5a32cd10358356fcf87fcf5ada
SHA512 935b3e7f5991537c0b053e3e961d74fc95f7902e916b2b88791482d20656435e43882ce75de1cc7312784e4de50c63a0d163a875b541cc0bd6e760a2e0751c00
SSDEEP 48:qlGxnrQJh5kVh/MhFP3szhlL0cakvek5k5mhWC+nuJqXBQ1:qqrQLmnkhF/szhlSkvek5k5m3+nugx
TLSH
T193912FB79602B472D7680AF318A757E7A3B9E1343758D24ACB3609152C624F39F38782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autE163.tmp

Path C:\Users\Admin\AppData\Local\Temp\autE163.tmp
Size 188KB
SHA256 80e6db57ed1e5fea17230f83a1a65e52b3995a4c345ad37240851a22f9385e1e
MD5 00c7b36f3869ea9965b5df453aa4e775
SHA1 843c3bf102e4665fce702d68fc5157cadcd2ebbd
SHA512 7bb789ee451612703d12da6d45254990479026660e06757701306f1551baee4576525c74bd28836874097e8ac5b323a690fa2c7833ff59b8427e6087ecbf4bc2
SSDEEP 3072:E/ePz5jcOaxOFUt11qVgn56nZQQDI1bOXae5owADooDYmlgwuXH2e5o84NNStsY+:E/edAOaxiUtjMgnAQ4IwXX5no0mlCXTm
TLSH
T1FB1413E3A4EFE744CB0320BF059DF9E2F1D48E699247A72D0A2235F43D5862853D586B
MD5 SHA1 SHA512 SSDEEP TLSH