e1027c2bc5cacd49b54eb0a02f2421c171f28344ca241ea9d6df816a088133be

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.AutoHK.og.exe
Size 955KB
Sample261006-vm2waa1x2r
SHA256 e1027c2bc5cacd49b54eb0a02f2421c171f28344ca241ea9d6df816a088133be
MD5 cb29db2d8ace5ed8d9b129de05230b2e
SHA1 e8f313551b00c48ed469d7cdf65391224e12ace3
SHA512 c45b7dd17a8ab0eebb6788c77785242b0927a50cf192c57ad08e7ff943c889692ee0a75e154ccc3fd56f2d6fa9d73b006945e15dee35a7cea05ae7efded6be99
SSDEEP 24576:O08VtNvq4dGSrUsZi4r65iAA0BCyC/VavRBkT9I8xKy3:F2anbqVav8TpD
TLSH
T123257C13B3DBC0B2DF622AF3D7755732193AB920473CA5DB72902E2DD8906C16AB9315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4880	webhost.exe
3320	webhost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\web.bat	webhost.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1280	cmd.exe
4884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.AutoHK.og.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	webhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5636	schtasks.exe
2808	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3320	webhost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 4880	5784	jaffacakes118_Trojan-Spy.Win32.AutoHK.og.exe	87
PID 4880 wrote to memory of 1280	4880	webhost.exe	89
PID 1280 wrote to memory of 5636	1280	cmd.exe	91
PID 3320 wrote to memory of 4884	3320	webhost.exe	94
PID 4884 wrote to memory of 2808	4884	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.AutoHK.og.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.AutoHK.og.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\ProgramData\webhost.exe
  C:\ProgramData\webhost.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c web.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn Web\Host /tr C:\ProgramData\webhost.exe /st 00:00 /sc once /du 9999:59 /ri 5 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5636

C:\ProgramData\webhost.exe
C:\ProgramData\webhost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c web.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn Web\Host /tr C:\ProgramData\webhost.exe /st 00:00 /sc once /du 9999:59 /ri 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

webhost.exe

Path C:\ProgramData\webhost.exe
Size 955KB
SHA256 e1027c2bc5cacd49b54eb0a02f2421c171f28344ca241ea9d6df816a088133be
MD5 cb29db2d8ace5ed8d9b129de05230b2e
SHA1 e8f313551b00c48ed469d7cdf65391224e12ace3
SHA512 c45b7dd17a8ab0eebb6788c77785242b0927a50cf192c57ad08e7ff943c889692ee0a75e154ccc3fd56f2d6fa9d73b006945e15dee35a7cea05ae7efded6be99
SSDEEP 24576:O08VtNvq4dGSrUsZi4r65iAA0BCyC/VavRBkT9I8xKy3:F2anbqVav8TpD
TLSH
T123257C13B3DBC0B2DF622AF3D7755732193AB920473CA5DB72902E2DD8906C16AB9315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web.bat

Path C:\Users\Admin\AppData\Local\Temp\web.bat
Size 100B
SHA256 f0b8aa6e6d86ac280cae86fc2b501b1bc5073c3057abf42252ccc3d2f0ccda79
MD5 df2082eeaffcae3924b93d99b37a95a4
SHA1 ab302f004f1ab89d44295f92cd2dc261702e655e
SHA512 e236308156e2f6c59d67a2fae46806542bfd0379607531c7496ef4f8eb759cfe069484597506d539e0aed2c386a424852679c5c518e11ab1e83174a2b4859f83
TLSH
T142B0120DAB26C7405805249713274B8EED88D417B1C808A4425701AC8002D2C311F351
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads