5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe
Size 48KB
Sample260924-e8nmsayxbx
SHA256 5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345
MD5 81a35f656d71ae1f96e60c4ded5c7ce7
SHA1 f90099dfcc3e2a126034ea7fb0f6a7c809fbce78
SHA512 a6bbf7328a02cf9379cf2dd8c7ff2639aaabc9fa4f2ebf9265493c4a3296f4386a16232269870329b329d154937c0edc3f0fa577a2602f97ca7439817ead6574
SSDEEP 768:xwDaNg0QqHE8/s8RALkZWWxGkqj02kHbat55xLBH:xwDsVQ0E8U8RA6qw2kKnVh
TLSH
T10D234B47B66154B2CADE053430BFBB160F7B9D30966AC9E3DBE32F495870217953290B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4116	lenschk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lensch.dll	jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe
File created	C:\Windows\SysWOW64\lenschk.exe	jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lenschk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4116	5100	jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe	89
PID 5100 wrote to memory of 928	5100	jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\lenschk.exe
  C:\Windows\system32\lenschk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345.exe.bat
Size 274B
SHA256 18a858003a6768c2d86e64a5b9cf32a9f11d9b4b13bac4b4c9c1f8f0f6ed2ca7
MD5 8af13f12ab5fc36fd9ab5b430dd4b701
SHA1 6631269fbb102386f7ad770db25bb3d2699da597
SHA512 b1c64fa90b498cb15eb0c386d4547e602a941895b01d8c6c8bd99f05df8f7278ce53c53590e3a5cc5cd4e0b3ea0d46c3c05042d04f516cde84365d160ff11daf
TLSH
T169D0C284C0EF888D3C0CF98FC930AF8642116DE42DCB2F176736C999136001876CAA4C
MD5 SHA1 SHA512 TLSH

Submit Download

lenschk.exe

Path C:\Windows\SysWOW64\lenschk.exe
Size 48KB
SHA256 5f5bf47709b2808887eeb29f930c5ada314a9148969e811e0e06dd93f1fe3345
MD5 81a35f656d71ae1f96e60c4ded5c7ce7
SHA1 f90099dfcc3e2a126034ea7fb0f6a7c809fbce78
SHA512 a6bbf7328a02cf9379cf2dd8c7ff2639aaabc9fa4f2ebf9265493c4a3296f4386a16232269870329b329d154937c0edc3f0fa577a2602f97ca7439817ead6574
SSDEEP 768:xwDaNg0QqHE8/s8RALkZWWxGkqj02kHbat55xLBH:xwDsVQ0E8U8RA6qw2kKnVh
TLSH
T10D234B47B66154B2CADE053430BFBB160F7B9D30966AC9E3DBE32F495870217953290B
MD5 SHA1 SHA512 SSDEEP TLSH