415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe
Size 48KB
Sample260924-e5ewga1w9k
SHA256 415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac
MD5 74ad10bed95150b5f59f8601af6dee3d
SHA1 97a10f235f479b2e968b452a203cd9dd2986fe4d
SHA512 5b13bb165bfaeb40941def633277f0803a15b4a2c1a29177771f80ab3304e78e3d1bcb9778beb2742a02eb6504134635f5444714286469f666e4c2267154ab85
SSDEEP 768:OcGAMYNgEB/MiozSMyBKyGccwhuOubHat5OxLBH+0:sAMWvB/MioABK8uLa0Vh+
TLSH
T183237C46A621A8F2C6DF013034BF37260AB76D34967EC8E3CAE72E459CB13535475807
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2868	lenschk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lensch.dll	jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe
File created	C:\Windows\SysWOW64\lenschk.exe	jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lenschk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2868	4780	jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe	89
PID 4780 wrote to memory of 1416	4780	jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\lenschk.exe
  C:\Windows\system32\lenschk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac.exe.bat
Size 274B
SHA256 2f6b5e820430eaca902e75726fe400f351def1be11b6ef0551b6d52e3718377b
MD5 25dbda37d4fd6c3fbd560d67992d9069
SHA1 622cdf979e4ab87fc37150b7a951489a22cd78b0
SHA512 1fb1b6447841cafdb5cc92fa8f84291995233ca33182d8b151fdb93ec96b2b2572f32773a69fd5ef155b34d70c48f7129ead3dd017f31381c3c2aa0566ba8ca4
TLSH
T174D02B94D5A6C9F7BC84D87F1B7C7B4A62121D842F853B22053185E4628D278F1C2750
MD5 SHA1 SHA512 TLSH

Submit Download

lenschk.exe

Path C:\Windows\SysWOW64\lenschk.exe
Size 48KB
SHA256 415a95a92d686c60f809bc4d8abd24a412ba5a0cec1b565ce4107861ef02c0ac
MD5 74ad10bed95150b5f59f8601af6dee3d
SHA1 97a10f235f479b2e968b452a203cd9dd2986fe4d
SHA512 5b13bb165bfaeb40941def633277f0803a15b4a2c1a29177771f80ab3304e78e3d1bcb9778beb2742a02eb6504134635f5444714286469f666e4c2267154ab85
SSDEEP 768:OcGAMYNgEB/MiozSMyBKyGccwhuOubHat5OxLBH+0:sAMWvB/MioABK8uLa0Vh+
TLSH
T183237C46A621A8F2C6DF013034BF37260AB76D34967EC8E3CAE72E459CB13535475807
MD5 SHA1 SHA512 SSDEEP TLSH