0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5.exe
Size 45KB
Sample261002-jmdb5scg84
SHA256 0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5
MD5 82acc320ca0e89c54a948ef268eb35f7
SHA1 9a113c0629944bbc2a2568e9f00f972836c6909e
SHA512 593e5354c834ae136348565ae0b40c07ef0aec90616cb2492131c253b42b27b9f4cdf585ee3208730ca4c59eca6374020e8ce79c462de4c6b67ba0730dc4ab46
SSDEEP 768:k2gpFmvbXimSBlWRVJqYOF6dXm3jI3bOuAlyFkjv6Wpfki51uy54N/qLszgk3hWJ:GKiYAF65m3jZlfjv6Wpfki51uy54N/qH
TLSH
T19E231B1A6B834B71C52146B0452FA1B7A6217F2A833150E7676AB75CDBB139CFF34930
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe
File created	C:\Windows\system32\drivers\etc\hоsts	cmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hоsts	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1180	1624	jaffacakes118_0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5.exe	89
PID 1180 wrote to memory of 3572	1180	cmd.exe	91
PID 1180 wrote to memory of 692	1180	cmd.exe	92

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3572	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0565d9d7c37f61ff4cc3af6fd0e94853d55fc5e5ee799978d6fa94cd14a179a5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6FC7.tmp\PODARKI.bat" "
  2⤵
  - Drops file in Drivers directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +r C:\Windows\system32\drivers\etc\hosts
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3572
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PODARKI.bat

Path C:\Users\Admin\AppData\Local\Temp\6FC7.tmp\PODARKI.bat
Size 6KB
SHA256 180ca3d3970c5e4ecfd3faa38248dca53df2eca5c5d89a0034259459480ff9ba
MD5 f93eb737afc9eb480dab21b8883e4651
SHA1 ce8d97c9a915aeae2149a50fb9713a4eba40eefa
SHA512 6e8fd54dfd0d92b794b04996ff5d4865d100f50111c60f8a72c7a5f217bf090168bb14c6a437aa0f4d016c12bf33ff89a746dcda1b20496ea8846f9446ed182e
SSDEEP 192:OFtFFFgFQFzFFFaFAFvFfFQFoFXFqFHFFFwFlFuFpFmFiFNFPFcF5FAFWFnFNFcZ:Ojv6Wpfki51uy54N/qLszgk3hWLSkNjU
TLSH
T1BED1FE2D0787AFB656245120E12FE2BB3611BA79527A54933AFA33DCC5A070C7F21E31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 366B
SHA256 c2ce08a70e5f8b616119c8584264d2c7d136086987c7bb524e76cbc9207965aa
MD5 92db5739ceb182af33f0d334276a9ad8
SHA1 d2895e509bc8187d0ba29dd7107e49729b408229
SHA512 ad19939acbe585a699190e5f24181840a61637e47bf8a886803cab9f54ce077cb59220b03efa343462d61639e90fa965d992611dfd7034210865cc0238ad104f
TLSH
T1DCE0F5966FB38044CF12A952C3E04E1439BE12CDA407BDD91FAC722DC85D54838988A7
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 968B
SHA256 8bfef433369f2d62c78c03032cd62a488c0cebd79de81cf2ca7b4a1bd8136bcb
MD5 a2c86eefff2e13332d4a688c63d44b4b
SHA1 faa86d407a51f3e8692c5f84588fc95db0537662
SHA512 6f3b47f2f16db198f97b83c33db396b0c832b63fb480e17d9ee0cc91b24c0ad0bf0c92003d24613425a42bb4fdc0c53811b73182117cd4a3373b435eed1ae65a
TLSH
T1091110536FF39485CF12A553C3904A1836AE528DA00BB9D82F9C767DCC5E94538A4CF6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1624-0-0x000000000040A000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads