f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe
Size 44KB
Sample260924-e6j7ksea77
SHA256 f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c
MD5 94e5fbb897eef9d3b3be446dce87c3bc
SHA1 1168f192d4ccb9ff69775b6159985ca74bad6f6c
SHA512 ad353265e0699d71dac937847ea31ece4d1791c4943c0bcb6d2d93522157022b28b5ab56d992525b0ffbf7202f09a459123a9613b63eee56be6fc07f844afc4f
SSDEEP 384:EE2RuIVieHKxvvNgQi2wQ/zOlK7/tlc2iSt7TmcJVUHcsDB8pct51uL:+5IHNgQi2wQ/6lStlc2FycWNDCat52
TLSH
T190136C4B9A825073D4C90AF134DFBA175FB76F3813B35DE3CA5B2A8425705564D3A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1628	johandyk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\johandy.dll	jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe
File created	C:\Windows\SysWOW64\johandyk.exe	jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	johandyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1628	4776	jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe	88
PID 4776 wrote to memory of 5056	4776	jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\SysWOW64\johandyk.exe
  C:\Windows\system32\johandyk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c.exe.bat
Size 274B
SHA256 b68f583729f52d4aa610efff1c60e3f4c100d865386b42fb5281f5f0a459f1d9
MD5 554543340b3ba3b39b4a4ee495a2a3d3
SHA1 462eb2c3a02fb4ae83aeb262fb5d1b9750a3ceb4
SHA512 1e810a367301912d33da946bc532566b0fd9b3f9900c7681d1fb8818978f03fa1712d41f25e5f6333adbc2a02244656b0a07f0bb94631c7dd9b0e66eb6f908b2
TLSH
T1F1D02B885107470E7602D41F4634866DF1793A5523DD1E1A011185F459A20ACF7E5A0C
MD5 SHA1 SHA512 TLSH

Submit Download

johandyk.exe

Path C:\Windows\SysWOW64\johandyk.exe
Size 44KB
SHA256 f16a71903e75e60bbfd5e8d2995242e4b79d08357ce7d3d7186579252756350c
MD5 94e5fbb897eef9d3b3be446dce87c3bc
SHA1 1168f192d4ccb9ff69775b6159985ca74bad6f6c
SHA512 ad353265e0699d71dac937847ea31ece4d1791c4943c0bcb6d2d93522157022b28b5ab56d992525b0ffbf7202f09a459123a9613b63eee56be6fc07f844afc4f
SSDEEP 384:EE2RuIVieHKxvvNgQi2wQ/zOlK7/tlc2iSt7TmcJVUHcsDB8pct51uL:+5IHNgQi2wQ/6lStlc2FycWNDCat52
TLSH
T190136C4B9A825073D4C90AF134DFBA175FB76F3813B35DE3CA5B2A8425705564D3A20B
MD5 SHA1 SHA512 SSDEEP TLSH