dc40414247aec63cb56c0ca8f230c9dbe0ddac1866b85b34c72db1283650e309

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe
Size 4KB
Sample261006-p14ddayt9m
SHA256 dc40414247aec63cb56c0ca8f230c9dbe0ddac1866b85b34c72db1283650e309
MD5 e929d16ed87bbb0a8ec6228f8909aed2
SHA1 be5cee179de78e10329d9c1b93149be2d08f3b1e
SHA512 c47472b6f210a57b5253be1cfb84f16931652f3ec50c1b381b2ec5c8e979beb6aeea97d51e6c830a8c67ae2e3a78e0c77c09962a93f3e588695c331a5670017d
TLSH
T15C81D8FBFB9406B8C81296B650FE5447A95E2C2B139500F3CDA368973660FE661172C7
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3420	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3420	2488	jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe	88

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\febc.bat "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Downloader.Win32.Small.bbr.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dd[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8999WJP3\dd[1].htm
Size 11KB
SHA256 d896bfe9a1bf73af402151594b03bdb1907f3e974d81b6e854c67f58cded3778
MD5 fba3eb7ad81aa1e74e2ca08b9cc318f6
SHA1 2c202f342fece92ba752d8dc6807c2535c39df7e
SHA512 b580808a5e2baf687272640d483fcbd0e5e57f5f73c055dbf67052010118dac726627fd523d098687de82ba25cdd1af9f0684b41c394b905b2c4b99270efd0d3
SSDEEP 192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzcQQ9VFAE6+7My3bajtqi:sXX+/DV7k/3HQ9VFAEN7f3bajtqi
TLSH
T12E42D64CEEB0A3F0F22203ED37AF699E266461D31049C640F58C6FA46F0B3AD4547E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

febc.bat

Path C:\Users\Admin\AppData\Local\Temp\febc.bat
Size 70B
SHA256 2d8efe1526fa203539bc77da8570b4cb38d5a63836a76d2379b7b506d0a67ee0
MD5 677931564938373367422e56cdf23934
SHA1 fb077020992d9fa49a901d3b64c3d9ce5bb88b35
SHA512 808e177716911a5b975449b55df4fe1fc97cdb929be621fe541a7dfe7dce3362039214fe1ab4760c4d67aafe8a12308d04e5a40dc028b848c154f3e3f2d120ba
TLSH
T19BA022F080808388AC382A38882F038CF30C80C380000C2AB82300E0F2A23A3830AE82
MD5 SHA1 SHA512 TLSH