7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
Size 49KB
Sample260930-nsd8va11ct
SHA256 7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c
MD5 7a942a98cebb61855befa3dcdf9e0cd0
SHA1 ad8ae840e8d96636ec261d1c86ef1f79c3045163
SHA512 e81480126f5d9b8cc67cc5443113c8f91a30a74c4cc6b0006c57a4256b19d798465052b71e0a204bcf20dbfb2ae8d18f9fc9f354d45875ebc613cb99ed4170f1
SSDEEP 768:fcuJCkF6eW9O1Ry7tUb0HvYOpceGnuh//HwT0+7Y1GSjD9o3HGWX:oXFQ12PgOpoe5uHh
TLSH
T155334B22E6406377D0D22FB0857393A9995EBBA00502664F2FE42DBBFF732D16E11D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\icf.exe	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe:exe.exe	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 596	3236	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	89

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4948	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4904	596	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 596	3236	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	89
PID 3236 wrote to memory of 4948	3236	jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7bb4bb90251be81c1eeb2e4f36ac593db11d3fac777d686566ecc773e9c7657c.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 596 -s 236
    3⤵
    - Program crash
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\9306115.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 596 -ip 596
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9306115.bat

Path C:\Users\Admin\AppData\Local\Temp\9306115.bat
Size 327B
SHA256 eadc5d54cc45a2f2b0089c50da5bd5b90265677002bab4f1a07749f1f692a102
MD5 b35a8d4c2a618e003853234f334c7fe7
SHA1 0c1c9ab946a451ddf848d2ea09da6713299c4426
SHA512 0d61be075fb1e821a7567adcd1cacf9c2aa5781fe939ae046a2187dd217bfb6aac85bdb8967946919e5f87a63895c02c1d4915a7c6a76743dba00980ae3e7794
TLSH
T174E0CDC14ABA475E585CA67B4B3C96EBC0F04D051F562F710731CFC545A900DB5D778A
MD5 SHA1 SHA512 TLSH

Submit Download