32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe
Size 48KB
Sample260924-e25bysea39
SHA256 32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b
MD5 09c5ad142decbdac0a456d0013349506
SHA1 47f61e4c1552fd783fa12fd5bd710910bb4ed6a2
SHA512 449cb203789076df0c0dc2b9286340f56d63db8d7556460618093d91e57a7a29f3c7b43471867cf691867bb4d5e63311bea06d2011d1e6c76db79b90e399c4ed
SSDEEP 768:n6x0Ng5ApKZn8RdO9mnqybJkuk/Q0at5oxLBHo:n6xqgApKZG0YWuqyGVh
TLSH
T193236C07A92158F2C6DE017030BE77260EB75E34837AD9E3CAEB3F855DB02135525A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1268	lenschk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lensch.dll	jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe
File created	C:\Windows\SysWOW64\lenschk.exe	jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4584	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lenschk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 1268	5564	jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe	88
PID 5564 wrote to memory of 4584	5564	jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Windows\SysWOW64\lenschk.exe
  C:\Windows\system32\lenschk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b.exe.bat
Size 274B
SHA256 82c58044b6c02e9cc843858b3ff10e97e3a56d9d733bdf9ef2a3147765b963c8
MD5 436a389dc8443a4443c4d659eef3f76c
SHA1 a6cc4c439cedc138d33ca28600a14dc89ec55b3b
SHA512 b2f897f0c11aeaff477018d378ccca5d25d380631baf8a230e871e01e615c194a3840dc3f84ae13838dbd5f810bc27f8bb16ee75c36572f185dc80fc8134a47a
TLSH
T17FD0C2A460E1CFE24D08A1BB083B9B9C780009F71BD42B214A33C6886152418E987680
MD5 SHA1 SHA512 TLSH

Submit Download

lenschk.exe

Path C:\Windows\SysWOW64\lenschk.exe
Size 48KB
SHA256 32d3bd8d43493e12e38d26eac3d2819499037594dea04ea195506154a07f3b1b
MD5 09c5ad142decbdac0a456d0013349506
SHA1 47f61e4c1552fd783fa12fd5bd710910bb4ed6a2
SHA512 449cb203789076df0c0dc2b9286340f56d63db8d7556460618093d91e57a7a29f3c7b43471867cf691867bb4d5e63311bea06d2011d1e6c76db79b90e399c4ed
SSDEEP 768:n6x0Ng5ApKZn8RdO9mnqybJkuk/Q0at5oxLBHo:n6xqgApKZG0YWuqyGVh
TLSH
T193236C07A92158F2C6DE017030BE77260EB75E34837AD9E3CAEB3F855DB02135525A1B
MD5 SHA1 SHA512 SSDEEP TLSH