36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe
Size 48KB
Sample260924-e9gkvs1y2l
SHA256 36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82
MD5 4c63da1fdd73d53a4db71c62b809be60
SHA1 32b08149a5a69a737d4f5d10753d4876b123ac8e
SHA512 60125881b789f01ac92ecb99e2c8f8e6a06e43f206948dfa9a89488f9ed72ec2b7875be3fc09323d0d5b6cce309538461b5d4d4e27995885e407e3f3bcea3b31
SSDEEP 768:x3NYONqFXnLKh7EWAeEkqbdcNkHGat50xLBHRp:PYOsRnQEkq6NkX6VhL
TLSH
T134235C4AB01168F3C6EF053435BA731E0BB76D309AA9C8E3CBE72E8959609569125D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
712	lenschk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lensch.dll	jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe
File created	C:\Windows\SysWOW64\lenschk.exe	jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lenschk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 712	4404	jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe	89
PID 4404 wrote to memory of 3820	4404	jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\lenschk.exe
  C:\Windows\system32\lenschk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82.exe.bat
Size 274B
SHA256 cdd51e83488eba4c6fe6fafafd5112dad47d26a6e2c17cacf62436c18fb8bf8d
MD5 ec8bd71dee52cc1e4ce4a92d6e3fb54c
SHA1 83d1707ce7b5e4b5661fb87fe212afed6f6cb79a
SHA512 15580f7f4656222c94a2e7f258f907c81b77da9d70d65bdf4ef1159c95c51a864bd657ee5b21ef6f745d823d5b2c6cb2fd359634c98cf1e2d0eb4ee012c336ad
TLSH
T166D0C28081C3CE970804C43B093086C780A29E262A8C1B510B76C1896C9301DE296B43
MD5 SHA1 SHA512 TLSH

Submit Download

lenschk.exe

Path C:\Windows\SysWOW64\lenschk.exe
Size 48KB
SHA256 36e65754a398d876e685c567d284a7105a721e41b14685af97863fc302245b82
MD5 4c63da1fdd73d53a4db71c62b809be60
SHA1 32b08149a5a69a737d4f5d10753d4876b123ac8e
SHA512 60125881b789f01ac92ecb99e2c8f8e6a06e43f206948dfa9a89488f9ed72ec2b7875be3fc09323d0d5b6cce309538461b5d4d4e27995885e407e3f3bcea3b31
SSDEEP 768:x3NYONqFXnLKh7EWAeEkqbdcNkHGat50xLBHRp:PYOsRnQEkq6NkX6VhL
TLSH
T134235C4AB01168F3C6EF053435BA731E0BB76D309AA9C8E3CBE72E8959609569125D0B
MD5 SHA1 SHA512 SSDEEP TLSH