7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
Size 49KB
Sample260930-nsd8va11ct
SHA256 7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c
MD5 7a942a98cebb61855befa3dcdf9e0cd0
SHA1 ad8ae840e8d96636ec261d1c86ef1f79c3045163
SHA512 e81480126f5d9b8cc67cc5443113c8f91a30a74c4cc6b0006c57a4256b19d798465052b71e0a204bcf20dbfb2ae8d18f9fc9f354d45875ebc613cb99ed4170f1
SSDEEP 768:fcuJCkF6eW9O1Ry7tUb0HvYOpceGnuh//HwT0+7Y1GSjD9o3HGWX:oXFQ12PgOpoe5uHh
TLSH
T155334B22E6406377D0D22FB0857393A9995EBBA00502664F2FE42DBBFF732D16E11D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	59	204.117.214.10	804	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
File created	C:\Windows\SysWOW64\icf.exe	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
File opened for modification	C:\Windows\SysWOW64\icf.exe	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 804	5000	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	86

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 804	5000	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	86
PID 5000 wrote to memory of 804	5000	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	86
PID 5000 wrote to memory of 3944	5000	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Unexpected DNS network traffic destination
  - System Location Discovery: System Language Discovery
  PID:804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\6750211.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6750211.bat

Path C:\Users\Admin\AppData\Local\Temp\6750211.bat
Size 327B
SHA256 88905db993f44b3d5cbfa69f29cd1d2e301cf48a96cfbb5bb1f7359e87d6835f
MD5 4e4f31a58381c08f5c2b9e15932d496e
SHA1 0f928fdefa2fb932b1db3224373a8c540e3f7b7c
SHA512 90d5aac96404f59390f02b0b1103ce1b48b7045f2dc5b6fee61a7dce66f1e096b4fa49b4e2e2500788fcb61c334f89e3d6fb0571031db1dd19a691cd98760565
TLSH
T1E8E07D4549B6C75E4864E6374F3C52AFC0E009041F562F210721CB8580E901CB1D368A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-1-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/804-4-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/804-5-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/804-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads