606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe
Size 14KB
Sample260930-mt58aa1brf
SHA256 606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307
MD5 3c9b4ffe5ade98958b31701be18ffcf7
SHA1 2f217a82c69de3c40d331aa92ee411ab95ab1fec
SHA512 a6fb340b69c240f62e2de59016b169b3c16bd138b81f8e32e225b383efb0baaa5cb928204f19d0b85ea20ea539149cbca590b3a790c8e846630da267ab82c52b
SSDEEP 384:SLm/VdfgRPHhFFaAzdZj5E6KvKtVAcFDYCIw:SOVdYPHhFFaAzdZVGKtCcFDYC5
TLSH
T134521966BF548BE1D86489FC51B88D071F2E6E56576CA7EFCA102CC7E44A0C2103F65E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1552	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 1552	4352	jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe	86

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_606a83b6c43e8f83898fd8634fb42fcc8e24c3a2bda998268369d3fa4b4ee307.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_un0.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_un0.bat

Path C:\Users\Admin\AppData\Local\Temp\_un0.bat
Size 365B
SHA256 47619a9b44b9e9f07b43999abc03af03c651f6e84f4a03a961f45568e144404e
MD5 01255d3eeab67fc1eccfb27428ce097d
SHA1 9bfa10c04d678554d43fd47994e4bab73d025cb7
SHA512 0e1c6c61e86cf5bcc571a9dcc555dbbd6b72861fdb0873e5a234bafca931fed3746b399f4f2ec51790dae5264a0fa6c7291cb93c8cd6b75c91eab74ceeff46f9
TLSH
T179E0D84A01D6DB5BA50CC26F8671229E81246FAC3F4B2B44576785C832D281EF6A2A0A
MD5 SHA1 SHA512 TLSH

Submit Download