059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe
Size 44KB
Sample260924-3wbdpas19l
SHA256 059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b
MD5 c97df5bb73f2d50018aa97516e43754e
SHA1 2a634ae6eaffb75706f0ca70aa07d44b97050673
SHA512 ca5aeb4424e665b5b1ae9fa701572f7b101e9e0afff01905fcc508a6e506b7365c75b131755d2470ec7bf9d7a6fdbc8e110fb8c09b4bcb736dbab9e5bc1811c2
SSDEEP 768:c2BNg2FGGcPe42BnV5TdUqyat5JxLBHTlx:c2j3oPe42RZUqnVhp
TLSH
T19E133986BB14C4B3C2FB05F9643A663A5E7B6D3106728DA7EBB326C02C241519D3661F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2244	tiplictk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tiplict.dll	jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe
File created	C:\Windows\SysWOW64\tiplictk.exe	jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiplictk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 2244	4152	jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe	88
PID 4152 wrote to memory of 5088	4152	jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\SysWOW64\tiplictk.exe
  C:\Windows\system32\tiplictk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b.exe.bat
Size 274B
SHA256 0da4721a42b75c49c2c602a2b831dc7fbe6f2b93b4948676cf6c9cdff124b3a7
MD5 e711b327d8bfe871861950824578ef1e
SHA1 7662345cc0d3ace70231dd7c40c4badf81e1a683
SHA512 6def47f28682bfe88403a9aeee2ef64062b0090bfe9b4d25d3a09ea60f6b6f7f4c1cc93354d15c75e92de8c87635386ae171409ccca66fa345ebe905ffd12de4
TLSH
T1F5D02B810302CCA70C08907B0D281D8CC0A6B777AA892F26D730CDD82040014B6B23CB
MD5 SHA1 SHA512 TLSH

Submit Download

tiplictk.exe

Path C:\Windows\SysWOW64\tiplictk.exe
Size 44KB
SHA256 059c9dc700a10c578687503f65e09a16b1d68355475c60d01698220a50ee406b
MD5 c97df5bb73f2d50018aa97516e43754e
SHA1 2a634ae6eaffb75706f0ca70aa07d44b97050673
SHA512 ca5aeb4424e665b5b1ae9fa701572f7b101e9e0afff01905fcc508a6e506b7365c75b131755d2470ec7bf9d7a6fdbc8e110fb8c09b4bcb736dbab9e5bc1811c2
SSDEEP 768:c2BNg2FGGcPe42BnV5TdUqyat5JxLBHTlx:c2j3oPe42RZUqnVhp
TLSH
T19E133986BB14C4B3C2FB05F9643A663A5E7B6D3106728DA7EBB326C02C241519D3661F
MD5 SHA1 SHA512 SSDEEP TLSH