d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe
Size 44KB
Sample260924-e9416aeb35
SHA256 d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45
MD5 8b9a96c5f51bd733e092fc23452a3b4e
SHA1 790eb738825bda0c7069456a4fb23eacc8dd628d
SHA512 86e2259c3025ab3514a4d9756fc1c64ebaf213e75c68ab746bdcead74e0828e42001ac04759c0a68d225bc9ab87f20180311506f2ccb66a6adc32d69c4931df7
SSDEEP 384:xI/zgqYBvrtLulVxlU4H4dwTGAFXywapct5jvOZ:xrqsrtKVbdRSAMHat5j
TLSH
T10713294BAE02E8B3D6CE4474295B563B5FAA593563A64CD3CBB32ED198201E44C33613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4664	mysibkk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mysibk.dll	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe
File created	C:\Windows\SysWOW64\mysibkk.exe	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5948	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mysibkk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe
1276	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 4664	1276	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe	89
PID 1276 wrote to memory of 5948	1276	jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\SysWOW64\mysibkk.exe
  C:\Windows\system32\mysibkk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45.exe.bat
Size 274B
SHA256 b1388b4b336d500cb03d9f3713c93eed09caf90463fbe60c45738b157a05d235
MD5 10996f4cfc16cad3d91d3153d11efa52
SHA1 74750b7b4643dcaf9eb4a254ebd136dfd74481c1
SHA512 3deda840f3de2e75b5a42cc3618d39c264e16080171d742646553581f19e8d6cc1d51928d86129bf1ff2d64989dd6dac2424e603b969ee46c95f626732a2f4aa
TLSH
T1DED02B5002314F457804D41F0A25378AC2079D743D443F0A271482F4352A40CB2C2709
MD5 SHA1 SHA512 TLSH

Submit Download

mysibkk.exe

Path C:\Windows\SysWOW64\mysibkk.exe
Size 44KB
SHA256 d7c68ccad800a8ba65ef7c296d8b442fff826491f48c8a84654310d0e24cbf45
MD5 8b9a96c5f51bd733e092fc23452a3b4e
SHA1 790eb738825bda0c7069456a4fb23eacc8dd628d
SHA512 86e2259c3025ab3514a4d9756fc1c64ebaf213e75c68ab746bdcead74e0828e42001ac04759c0a68d225bc9ab87f20180311506f2ccb66a6adc32d69c4931df7
SSDEEP 384:xI/zgqYBvrtLulVxlU4H4dwTGAFXywapct5jvOZ:xrqsrtKVbdRSAMHat5j
TLSH
T10713294BAE02E8B3D6CE4474295B563B5FAA593563A64CD3CBB32ED198201E44C33613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download