8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe
Size 50KB
Sample260930-mj62tszdkc
SHA256 8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493
MD5 3c03212dc5ef5afddde56f4ff5414038
SHA1 16e6b40658d3f5c63495e57f056ddcdff07e2d51
SHA512 eabd860b13d7d0ad2f6067ee4f8d78599659b84fbd8bbbff2ee0d94d219cd249c855803ba3e39abbcf874af5761edbe8bba226f57437909de7cfb9c697da24de
SSDEEP 768:aCfVFXRJVXGm1fTYz+vPzn8l4qymMhOldFEZlxqTxh73Ew/3Y:Xd3hbYz4Pz8lpHMhOlnEZlxqTLgw/
TLSH
T18133C726A748E2FFF5A36FF03092120B4899A1507554BF1BCE72AA33F863561FE11C56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:ext.exe	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe
File created	C:\Windows\SysWOW64\fci.exe.exe:ext.exe	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 4632	4176	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe	88

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5556	cmd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1436	4632	WerFault.exe	88
2816	4632	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4632	4176	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe	88
PID 4176 wrote to memory of 4632	4176	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe	88
PID 4176 wrote to memory of 5556	4176	jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_8d8a7d7c1d946020389bcc0788d43b51b975e8ccc3c3c593aa7094a08947a493.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 308
    3⤵
    - Program crash
    PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 328
    3⤵
    - Program crash
    PID:2816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\7274499.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4632 -ip 4632
1⤵
PID:3432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4632 -ip 4632
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7274499.bat

Path C:\Users\Admin\AppData\Local\Temp\7274499.bat
Size 327B
SHA256 ecbfaa5a53e604b2d1482e8b4d6ee5930653c6aa39697728f067aaddac30484f
MD5 4532a7f92553fc2d29b374c3913eb6b2
SHA1 b4e15292049fd320f41ff733fd9609df42bdc99a
SHA512 411b643b59fd010dfe7a748d22a66d92262bbaac4cfaf5bc930e20a9e95cd36d97f610b8a31540353776a174c65230d79cd50646e2159fd33dab6dc2c7e15236
TLSH
T168E0866543A28EAD08A9E06B0F7AE389A0A7597A1A899F210312D14951D242DF2C7388
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4632-4-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4632-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4632-7-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads