fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe
Size 44KB
Sample260924-3xa5bats2m
SHA256 fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a
MD5 45ebf7d0566bf28aa462d921d31cbe56
SHA1 19497282e1352d3d7c259907e98cf1dffcf1c6c7
SHA512 bce9fb6c7fc75c6d3bf71d32889138840867a32907f7d001a9932e6640225182add2e13c59cd33954e31b1d8d5175192601f296cb1666473e3a0f0dab176e3e1
SSDEEP 768:c2BNg2FGGcPe42BnV5TdUq0at5JxLBHTXH:c2j3oPe42RZUInVhL
TLSH
T111134986BB04C4B3C2FB05F9653A663A5E7B6D3106328DA7EBB326C02C241519D3562F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3488	tiplictk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tiplict.dll	jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe
File created	C:\Windows\SysWOW64\tiplictk.exe	jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tiplictk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3488	2236	jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe	89
PID 2236 wrote to memory of 2184	2236	jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\tiplictk.exe
  C:\Windows\system32\tiplictk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a.exe.bat
Size 274B
SHA256 a7f735e778bcb7699f81edcb1b91b6d6adb38f2db5d0ced5fb7f3f1c12cf1bd2
MD5 692b4a8e3d3f2a755f66f1ee87e59957
SHA1 285712fe73f5e8f4ac498ea345566869d2de9eba
SHA512 62c585078b2811edc2c34a6c2c900a5385534e95c878e87aefc0f1c0a7f180290f3132bfe685b27a76248bf94dfb9f88429d9c74812df560c0d13b931fd6b087
TLSH
T1D5D02B9D50528D81A401D92F0AB82A8CD0480FD031943F26CE23DED5265241DB1DFF08
MD5 SHA1 SHA512 TLSH

Submit Download

tiplictk.exe

Path C:\Windows\SysWOW64\tiplictk.exe
Size 44KB
SHA256 fe5a6ff799f77e036fe55aa099f1bd517c4040e93b3795093fc22e9463e0fd9a
MD5 45ebf7d0566bf28aa462d921d31cbe56
SHA1 19497282e1352d3d7c259907e98cf1dffcf1c6c7
SHA512 bce9fb6c7fc75c6d3bf71d32889138840867a32907f7d001a9932e6640225182add2e13c59cd33954e31b1d8d5175192601f296cb1666473e3a0f0dab176e3e1
SSDEEP 768:c2BNg2FGGcPe42BnV5TdUq0at5JxLBHTXH:c2j3oPe42RZUInVhL
TLSH
T111134986BB04C4B3C2FB05F9653A663A5E7B6D3106328DA7EBB326C02C241519D3562F
MD5 SHA1 SHA512 SSDEEP TLSH