9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe
Size 48KB
Sample260924-3rrj4she49
SHA256 9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6
MD5 99ad1d26ea806d99222c7148bc2c4db8
SHA1 52df778ffc0e4751271c18bed203434874d01bab
SHA512 f46976a57b3b294077342d21d791cbba0dfaf289e510cd676aa467c50e8536ea975269cc5c0bb33fc44b348c84939849dd95806fd257c1884752dac3c9170ae9
SSDEEP 768:dqzNgESugxomP2iZfmbpnUQJTRNat58fJmR:dqh0TyNJTSGfQ
TLSH
T132234B872762CCF2D29A00B1389E763A5FBB5E381326D893D7E366D99D205E39835013
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2824	hourpx2k.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hourpx2.dll	jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe
File created	C:\Windows\SysWOW64\hourpx2k.exe	jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hourpx2k.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 2824	5924	jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe	89
PID 5924 wrote to memory of 5612	5924	jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Windows\SysWOW64\hourpx2k.exe
  C:\Windows\system32\hourpx2k.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6.exe.bat
Size 274B
SHA256 ea8a9b66ab1994ff0eff1b84e5777d8a11db3510ff122833bffcbe78fcbbc955
MD5 22fbc540de655f80e0d21f43904e74ac
SHA1 58235347b4f5d15f8435cb56ca6df1d95e556385
SHA512 fb5559dc7eeb9099646939dbf33dfdecbeb6a9c0552fd85ce26e20c8c5303c418407b73be18b2491a95f0899a6cdb40792e9766a05c49c13f67627ef8eb57d08
TLSH
T167D02B08E19DCB552806C98F0C210E06D0744DE831473F19752385D504B7829F3C1B1C
MD5 SHA1 SHA512 TLSH

Submit Download

hourpx2k.exe

Path C:\Windows\SysWOW64\hourpx2k.exe
Size 48KB
SHA256 9baace7158acba0876d10033faa444a8481242bd4a29b910a84ae7ba1ffca7f6
MD5 99ad1d26ea806d99222c7148bc2c4db8
SHA1 52df778ffc0e4751271c18bed203434874d01bab
SHA512 f46976a57b3b294077342d21d791cbba0dfaf289e510cd676aa467c50e8536ea975269cc5c0bb33fc44b348c84939849dd95806fd257c1884752dac3c9170ae9
SSDEEP 768:dqzNgESugxomP2iZfmbpnUQJTRNat58fJmR:dqh0TyNJTSGfQ
TLSH
T132234B872762CCF2D29A00B1389E763A5FBB5E381326D893D7E366D99D205E39835013
MD5 SHA1 SHA512 SSDEEP TLSH