23564c8f6b6a5dc2fd0d20e56585fa150c1981705985f01c25731cfe78dd4727

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.MSIL.Keylogger.ckmt.exe
Size 657KB
Sample261006-vmf9kssthv
SHA256 23564c8f6b6a5dc2fd0d20e56585fa150c1981705985f01c25731cfe78dd4727
MD5 a58551c62550a6f9df6380d8ea4195f3
SHA1 7b7be51212e31b51948e5bfb6835aa952168bf71
SHA512 bb1c6cd6a621a94b53ec5d6bda3c60e4f20b45435ebfb4a3898c3c7075b840ed0f4232acfa02bc77d2d263df1124bdef6d378b47295a8c57935e598f4a359205
SSDEEP 12288:O2LSssmFzpjvTRFXkmDuARVtoV8wr1X/5TKrAGsD/IogkJCQfR0ghK6PxJ:O2usvpjrR/uHT7hw0CQ1nxJ
TLSH
T123E422913BF1C6BFE0C206B565916D6238BEF77507289487938058869BA4DC9F73B383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.MSIL.Keylogger.ckmt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4652	PING.EXE
4992	PING.EXE
5104	PING.EXE
4904	PING.EXE

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
5104	PING.EXE
4904	PING.EXE
4652	PING.EXE
4992	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2584	2500	jaffacakes118_Trojan-Spy.MSIL.Keylogger.ckmt.exe	90
PID 2584 wrote to memory of 2288	2584	cmd.exe	92
PID 2584 wrote to memory of 5104	2584	cmd.exe	93
PID 2584 wrote to memory of 4904	2584	cmd.exe	94
PID 2584 wrote to memory of 4652	2584	cmd.exe	95
PID 2584 wrote to memory of 4992	2584	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Keylogger.ckmt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.MSIL.Keylogger.ckmt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\%COMMANDER_PATH%\Utilites\install_button.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\chcp.com
    ChCp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2288
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 2 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5104
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 2 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4904
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 2 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4652
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 2 localhost
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TCFS2.exe

Path C:\Users\Admin\AppData\Local\Temp\%COMMANDER_PATH%\Utilites\TCFS2.exe
Size 13KB
SHA256 a2a08829215594166c73a30e6430f01120e0ceacdb9dec707b1273e9c4a0935c
MD5 d401e84fd05ee28534552b85a8fa02c5
SHA1 17499e8ec71d38e8ce4adbf452819291398f9df1
SHA512 da9f1b5e04187005362194cdc287859bf684c8285523a0f052b894a158817a709b0224e80469f1f182783e8f59442316bd95f3c57010ad16d56f966a13ae8efa
SSDEEP 192:LZmSi3HRANxoCOR7vb8FZWMHA5BwQ2WTnZvtgFQuBcAZfuyyI0ynTdwfS5:LZGHRANxor7j8FcFrTptgC140YWa
TLSH
T190522A5232E59577F0B21E3645762305D33EEE149A31CE9B96581C8F3CA22D2D476327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install_button.bat

Path C:\Users\Admin\AppData\Local\Temp\%COMMANDER_PATH%\Utilites\install_button.bat
Size 2KB
SHA256 1f4f7dd8af92f54176eab0c80dc901696cbb6dee0487dc62dcce8ebdd688a88a
MD5 9c184153bf3740892552c3e7947d7450
SHA1 f3880c7bb2a6c3b1bf61f4f18719f1bb167a7fdd
SHA512 44d8d5662a4e5d1891e433b39851ba46deee64bc171252256240fa41079142d09a30a578dc1893a567ce0d21e319358d8532990e16e69d72fca2a73622fdc11c
TLSH
T115413172700D68500E6003D35975A953FC2ED2E623A596BF2C139DEF2685FEE0C16FA2
MD5 SHA1 SHA512 TLSH