ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Size 161KB
Sample261002-jsg8aax15j
SHA256 ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa
MD5 f186c121b39fa98ba5c730b7f1fe1a94
SHA1 b0aa5d2aa9830f8ba6f99a2d09bbc4a39b297612
SHA512 b38ad35f03f2710f827a791f64ebd7e1f957f5173cdadfcbc1e18e7268742e6eb0f8f1fb68d8b0612cc38e610958f4f80072001efad309d1a487067a65d14e66
SSDEEP 3072:PszZnKNLSfWInbuLB9xeCBLu4+uIrjQ8dGweYOwYnWwRTy+Y8e4ZW1DUGKpPpMeX:Ps8ZSfWInb7CRu4EjQuG1T7WwR+j8hrD
TLSH
T157F3BE06A3D681B2E0824B30587D53BAD939FE05AF34E28FCB454E6E6C71911FD19B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1968	a881.exe
2924	b888.exe
1728	c6003.exe
296	fiare88.exe
264	fkreaak81.exe
1220	fkra6003k.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fkreaak81.exe	a881.exe
File created	C:\Windows\SysWOW64\fiare88.exe	b888.exe
File created	C:\Windows\SysWOW64\fiare88.exe	fiare88.exe
File created	C:\Windows\SysWOW64\fkra6003k.exe	fkra6003k.exe
File opened for modification	C:\Windows\SysWOW64\fkreaak81.exe	a881.exe
File opened for modification	C:\Windows\SysWOW64\fiare88.exe	b888.exe
File created	C:\Windows\SysWOW64\fkra6003k.exe	c6003.exe
File opened for modification	C:\Windows\SysWOW64\fkra6003k.exe	c6003.exe
File created	C:\Windows\SysWOW64\fkreaak81.exe	fkreaak81.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4084	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a881.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fiare88.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fkreaak81.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fkra6003k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1968	a881.exe
1968	a881.exe
2924	b888.exe
2924	b888.exe
1728	c6003.exe
1728	c6003.exe
296	fiare88.exe
296	fiare88.exe
264	fkreaak81.exe
264	fkreaak81.exe
1220	fkra6003k.exe
1220	fkra6003k.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2924	b888.exe
Token: SeIncBasePriorityPrivilege	1968	a881.exe
Token: SeIncBasePriorityPrivilege	296	fiare88.exe
Token: SeIncBasePriorityPrivilege	1728	c6003.exe
Token: SeIncBasePriorityPrivilege	264	fkreaak81.exe
Token: SeIncBasePriorityPrivilege	1220	fkra6003k.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 4084	5896	jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe	90
PID 4084 wrote to memory of 1968	4084	WScript.exe	91
PID 4084 wrote to memory of 2924	4084	WScript.exe	92
PID 4084 wrote to memory of 1728	4084	WScript.exe	93
PID 2924 wrote to memory of 296	2924	b888.exe	94
PID 2924 wrote to memory of 6116	2924	b888.exe	95
PID 1968 wrote to memory of 264	1968	a881.exe	96
PID 1968 wrote to memory of 248	1968	a881.exe	97
PID 296 wrote to memory of 4608	296	fiare88.exe	98
PID 1728 wrote to memory of 1220	1728	c6003.exe	99
PID 1728 wrote to memory of 4312	1728	c6003.exe	100
PID 264 wrote to memory of 4432	264	fkreaak81.exe	101
PID 1220 wrote to memory of 3440	1220	fkra6003k.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ea9accec4fd1089468c71166c1dff22977e58b089dc7a92b0c1fed98b02ad6fa.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ser.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\a881.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\a881.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\fkreaak81.exe
      "C:\Windows\system32\fkreaak81.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:264
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\FKREAA~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\RarSFX0\a881.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:248
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\b888.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\b888.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\fiare88.exe
      "C:\Windows\system32\fiare88.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:296
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\fiare88.exe > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\RarSFX0\b888.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:6116
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\c6003.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\c6003.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\SysWOW64\fkra6003k.exe
      "C:\Windows\system32\fkra6003k.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C del C:\Windows\SysWOW64\FKRA60~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\RarSFX0\c6003.exe > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a881.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\a881.exe
Size 36KB
SHA256 5638ed7225838ff3f77400d71522e95bc0162621f2fb16de1a46b8915a3fd0f3
MD5 85058298ba37b747e7857832c75ef3a3
SHA1 106e7de7ab28e271553292f2985649f6fcc259c9
SHA512 f9afab91055586778af720f2d21d8b843a86f26588fca0e921a8ac3c835ddffd2ae85166f6c57e91d91e6d03fcc999ff9d34141bd533ed7304bc9f0e5692c363
SSDEEP 768:03UqCzUYogPEdnRyn0TAuGjW3io8ykU/fbLrzPTP:03LCzUYD8dnRynGHio8eXbP
TLSH
T123F28E858CA84B95CC8B6F3565B6D50FF6A53739692F9F42B84C8F2526A0200FB5433F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b888.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\b888.exe
Size 35KB
SHA256 2fa7f0a4da43a3c31039dc71741ef0567ce0f6053a8bc1267f6b4bc62e6357ca
MD5 e45ac475d3e0e6eab56d8e411bbeb9ec
SHA1 22c1fb36299afc2313460a9b8be30055fb5b354a
SHA512 c5737e8dfac2b6bbaf86cbe11273f0e8cc0060da652fa1d87bd200e37cf5d0b24abab84d81422ce76135819523a9f79bdfdf6efab9cd639bfa7586e67d6a9486
SSDEEP 768:04ChXiz/NGuOF1UUdLWgjg72Vdh+FDHjIakieabLrzP6TJ:04tz/NjgjgKVrcDtwaS
TLSH
T1F7F2A0ABC7E76FC3E0943AF4EDA688D3C458E79C6516851553CC8E1D3C6C2049BB2297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6003.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\c6003.exe
Size 35KB
SHA256 d9a19bd49daf777abfdde7809f082b340328d70bd8aa60ffa4d100c10fbaaa2e
MD5 d3262f5f83542992ad4bd41975814238
SHA1 2261822463f7d84bbc62c4e73eb141c656ddbd8f
SHA512 c656dc34447a4dbfa4745278a8765d5e8004381a6f067f77c570a0daf1a29ab8a21773d4547f1d7fbabd92742eaf35f55e475c3048230cb99c3b2df81979fee1
SSDEEP 768:0V311WpTCjRq52NrLMPPFxtnBZPRtqfFKutsy6bLrzPMGL:0V3jWpTCjY2NrLMPNjnBZJA9sB0GL
TLSH
T1EAF2AE0D54752DD3C2C9593F09324BD3D8B9AC26402D974249F0AFE96FDF60E5D026E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ser.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\ser.vbs
Size 145B
SHA256 3d836e78b7284f61f24fe547c9cb21af2a501ae7d460249c53612982c8202d8a
MD5 bb9c2c191a708efc9e2956cde3555d15
SHA1 706bf20b79441c3adc0a674db514698182e568db
SHA512 16619c35449bf29a4616fb7e38e4d9d73f0e7159e5d67ec766017d1b01ce496c572d9585a7f68ca72af38c909b15c4cbc555da6700cb561639215148d49d5cb8
TLSH
T187C0482E788E9B321F2980F089E24A46C98A8442A1369C003450BDDE03F89605B1A1C5
MD5 SHA1 SHA512 TLSH

Submit Download

fiare88.exe

Path C:\Windows\SysWOW64\fiare88.exe
Size 12.3MB
SHA256 e2bf4d4d1212d01322c615f68d84a5b8b6c4205f5daa631480bdab316a9927f6
MD5 54a646e3f81b74a6b07511422d9d9a6f
SHA1 7a752ddd561b3bae54ed12acc9c71777d7e79dfe
SHA512 0551f0fd739aa95a2f2851df03f4c736a09796417c9704a016c0f12115a7a4c368c3246fe3323a971fe34902907e96545e0aec22ef6c39012d9fb1cbfd5a9359
SSDEEP 768:04ChXiz/NGuOF1UUdLWgjg72Vdh+FDHjIakieabLrzP6Tx:04tz/NjgjgKVrcDtwau
TLSH
T12ED62216668FD8012BDB59F28CA73877F00F497D6D8FA56BCBBC162130D8022276D267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fkra6003k.exe

Path C:\Windows\SysWOW64\fkra6003k.exe
Size 12.3MB
SHA256 d6a146460eb29c83d428935557640c39c31ecd55901625e16ceb844687cd2727
MD5 be8bceda74ce474ca4f518fec445f709
SHA1 7525006d691178f4cff8d634a152814d2093c59f
SHA512 d1b299553534562ea2caa474f79bae14e177acd77199ed5cf9838dd52252e4e5bf54d8d7d627f36271ba0a88268c44430443160a607e1e1f9e4c7a014d1be3ef
SSDEEP 768:0V311WpTCjRq52NrLMPPFxtnBZPRtqfFKutsy6bLrzPMGy:0V3jWpTCjY2NrLMPNjnBZJA9sB0Gy
TLSH
T1C1D62215658B9C152BDBA9B388B73677F00F483D6D8FA26BC9FC133170DA121292D267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fkreaak81.exe

Path C:\Windows\SysWOW64\fkreaak81.exe
Size 12.3MB
SHA256 84d0081a78c1b4af8e5fdae2a44255fa81ca5b1d8ddc0405058cd49c9321e538
MD5 af887708b50282da9542a0f9007075ee
SHA1 b96582f50ed860b3f87e5ee4ca4b9d8cf78a3d3a
SHA512 5f0fa4fa681220446d69d0340519be0736bfcca52860c019f163ee7425bd6a40ab2894ff084620850d2cc5b9cf3f5f91f1eb0b68eeafff04c84e723017675f54
SSDEEP 768:03UqCzUYogPEdnRyn0TAuGjW3io8ykU/fbLrzPTW:03LCzUYD8dnRynGHio8eXbW
TLSH
T19DD62215698AC8153FDB59B298A7397BF10E083D7D8FA17BCABC1321B1D1022256C37B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-52-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/296-48-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1220-55-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1728-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1728-51-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1968-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1968-45-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2924-19-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2924-42-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5896-56-0x0000000000400000-0x0000000000422000-memory.dmp

Download