c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575.exe
Size 64KB
Sample260930-mvx83a1cke
SHA256 c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575
MD5 a6cf0dd74389b988286c76420406d675
SHA1 ad86839ebb81e8018ac86c27a27153c3c1ecef3b
SHA512 89c866bc82cd774c3bb3568e0b73ddf3dd74e56fc55c91eb13a668b37b3d061a8d3a977a0ff29a6b5115808e03c2ebbb39863cd45eee549ed2a1d02d1a2e8f34
SSDEEP 768:wTvFT9yADv07bJF9BBkrWwHoNboINNbnBTsUmnJIRBQu7Ubinaq82n+cqI9:cFT3jqX9srtoNhJPlAA8K+R6
TLSH
T1E253F60B3ED4DE70CD4564F8E970C3A583F3FAF2967EE2075B83C05A6939E4581A90A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1848	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 1848	5940	jaffacakes118_c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c7157252b737929e725aae44272fbb99bb2b4fe07b2acee7675efb485ce8b575.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a..bat

Path C:\Users\Admin\AppData\Local\Temp\a..bat
Size 302B
SHA256 f9cba05a7631d0d247acc2a0e812f78c8cd69983138a49fb7e6fc2f513824f61
MD5 da627d12a6e8c036b3ecdd62ca19edd6
SHA1 690daddcefa948a6a70c7fce296343c9b58062b6
SHA512 d019d35e33ae206d55ed963b743281641070aeaa7ea9613b2171f944165598dc9029859190074c24ed074fcff5dad117c9c039cef25550eb626279f0d22fec19
TLSH
T195E0E75382454F4C480CB4170472878F80683815FA077F590D3150D50DE302AF9E11C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5940-0-0x0000000000690000-0x0000000000691000-memory.dmp

Download