c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe
Size 48KB
Sample260924-e21zjaea37
SHA256 c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f
MD5 4a4eb3fa9839ac8695104f1bd9013b40
SHA1 7147321b733ae3cbdac680fb39a2cf122cc12a9b
SHA512 36908735b311907992400906d78609db04f1e39328ac2a6c5f5af66129412a82dc36c35138676034484a660d3fdb28fc16b6ceca146135e4a9ff542eaa5c5e78
SSDEEP 384:dEygJWpxvrtmicLU1aWWT0wN7vYGRohs/HR7aeSH2t5uO:dDgJQrtQAXWT00RH/HRXSH2t5
TLSH
T14A236C4B2605BCF2D9ED053431B7AB124BBD4D30D67D99A3CFFB2E9A2C312464924A07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2904	thermaltinck.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\thermaltinc.dll	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe
File created	C:\Windows\SysWOW64\thermaltinck.exe	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	thermaltinck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2600	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe
2600	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2904	2600	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe	89
PID 2600 wrote to memory of 5112	2600	jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\thermaltinck.exe
  C:\Windows\system32\thermaltinck.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f.exe.bat
Size 274B
SHA256 31580af8ce63054a4e78d0259be47df06858ec009cde5bbf4559c458fe8e59c3
MD5 7f18a55ad5b06e04bfdea3da3fe103ec
SHA1 6ae7965c3f822cdb23a4ac8929fe0cd93ee8f126
SHA512 3a5966c43e06ee72ce712247c7a72fe0820c5755ede1f6cbca62d79fa430c37a76f00acd7e7b37233a0b6ef56ab3968f1fa8985a30a8ea0ef74a5cf7594310d2
TLSH
T159D02B6308B2D42A0904C86F09BE1159D0A907A81FDD3E1A4E73DDCC1936004E187F15
MD5 SHA1 SHA512 TLSH

Submit Download

thermaltinck.exe

Path C:\Windows\SysWOW64\thermaltinck.exe
Size 48KB
SHA256 c3e06e708d0ace4bafb01a74d6ea3d3b65d670135efcb2d2b1c3e6b784cbfb4f
MD5 4a4eb3fa9839ac8695104f1bd9013b40
SHA1 7147321b733ae3cbdac680fb39a2cf122cc12a9b
SHA512 36908735b311907992400906d78609db04f1e39328ac2a6c5f5af66129412a82dc36c35138676034484a660d3fdb28fc16b6ceca146135e4a9ff542eaa5c5e78
SSDEEP 384:dEygJWpxvrtmicLU1aWWT0wN7vYGRohs/HR7aeSH2t5uO:dDgJQrtQAXWT00RH/HRXSH2t5
TLSH
T14A236C4B2605BCF2D9ED053431B7AB124BBD4D30D67D99A3CFFB2E9A2C312464924A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download