a1d967887ec604a0e3dcc2d7ee3c4cac89f540460a808dde869799944246ec6e

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 364KB
Sample261013-148caacz2n
SHA256 a1d967887ec604a0e3dcc2d7ee3c4cac89f540460a808dde869799944246ec6e
MD5 0b64d8be23b9d2b18885917aef7c819a
SHA1 3cda57746007873b1cad221b3d2b5dc00e38c39d
SHA512 c4e80bc6b4d20ca8ddc977f6165ba459ebb7b5699bbfb2ce1643229503733b91c13c000c383b668dfb38ce654affe14a34cb561690c652732c06be3ab357dc6f
SSDEEP 6144:D9wq9AAuN9Ou0z0J6MOncEDqDBOeRWWZdeSl0GTdl/Wfm076ufGnHu:Zr6Ayxw0J6MOVDqDBhWW/eSl0GTdEfHr
TLSH
T1598481CB88976129E6AAF4F27118663CE04417CD4FB08CDF9336761448B97AFD1784BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4316	3608	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	87

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uninsep.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_uninsep.bat

Path C:\Users\Admin\AppData\Local\Temp\_uninsep.bat
Size 248B
SHA256 e20e06ebea59a9aaa2496c3e43ec3f64050366979fa36ff4b482436468cb6602
MD5 adfe0950c4f7c24c381f86615618b64b
SHA1 302a7a71e55d8db839fae1355f1e71cb3e864658
SHA512 bd1d44a64d19f21b087b46977f4e55df4916ea187c6bdaf090140e44f4cd5d0176eab90ecf8a33b1c7b7a4a1e6933e8a9fcdd4d91e6bc3f69b1772204436415e
TLSH
T149D0A5024143CB5D0454C83715749B4DD264CD5C2AC53F344331C5C4537341E77D6715
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3608-0-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/3608-4-0x0000000000400000-0x000000000045B000-memory.dmp