3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe
Size 52KB
Sample260924-e58tjsea76
SHA256 3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a
MD5 46e8a5159dd4b41321968ee51bff5e50
SHA1 e1abae3625f9471cbe791315a2bb9fb65626c175
SHA512 ec4765d68237e56a1c5b55a91070ff2a6e61ba3c6c71a1f22db7e1b8ccd6026b598dc930e3169e0df962441abce89f99a729155cad05835879aeedaa50da8797
SSDEEP 384:+wPu9btfYvlvTF9a9ir7wDpj4k9D/t5A49Q6kzKs:ZPm+1TF9a9ir7wNj4R49/kWs
TLSH
T182333B8B46A1ABF2CB6E013436CBAB1F19BA5E31295E7857E2D7B9025D350C1E184D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1660	rmchampk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rmchamp.dll	jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe
File created	C:\Windows\SysWOW64\rmchampk.exe	jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmchampk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 1660	3088	jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe	89
PID 3088 wrote to memory of 5644	3088	jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\rmchampk.exe
  C:\Windows\system32\rmchampk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a.exe.bat
Size 274B
SHA256 9d86732668823b6bba96c4913b45f357c93b734639610a64a13cacd9ca4190a4
MD5 7a661a3d4ae000529666930ceb18ac92
SHA1 b28ca9ab8f702cf8df7725f15c6effd7fb636959
SHA512 36b978d8da870465609be15b48be0d39df2466d968670b8b81d67c05bda1277b95a1edb51c62e45487be796c3319ff074931acdd1e4a179ad867f0c6ae180d26
TLSH
T118D0C2A452C38D9D8C45941F4679E58452322A54D28C2F022B3387E480B3038A2DE6C1
MD5 SHA1 SHA512 TLSH

Submit Download

rmchampk.exe

Path C:\Windows\SysWOW64\rmchampk.exe
Size 52KB
SHA256 3dd17361496eb7308647855a659adff7d716eac81ec5b04163fded83adbbb84a
MD5 46e8a5159dd4b41321968ee51bff5e50
SHA1 e1abae3625f9471cbe791315a2bb9fb65626c175
SHA512 ec4765d68237e56a1c5b55a91070ff2a6e61ba3c6c71a1f22db7e1b8ccd6026b598dc930e3169e0df962441abce89f99a729155cad05835879aeedaa50da8797
SSDEEP 384:+wPu9btfYvlvTF9a9ir7wDpj4k9D/t5A49Q6kzKs:ZPm+1TF9a9ir7wNj4R49/kWs
TLSH
T182333B8B46A1ABF2CB6E013436CBAB1F19BA5E31295E7857E2D7B9025D350C1E184D07
MD5 SHA1 SHA512 SSDEEP TLSH