53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe
Size 44KB
Sample260924-fgxxtaec46
SHA256 53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605
MD5 657bf97588d8a2ba50f24a744dcf7867
SHA1 8d053cd6d4532b296999f54ef5efbf2148952571
SHA512 d48bc7b3da82ea053d8bc33a6380dca9079bc04df14f2de71e6b40fd64bdda32241c5141a4a3faf319e13c8276db188f05d6f071321e7530e3367df090f26fb8
SSDEEP 384:+O0qEn6Y1EvqFGQ3RF5kjFy3xA73LEFsOEnBa28rGJ12wWfzB2pct5KHh:h0n6K4qFGQhF5kpiljEnUrGbWfzoat5
TLSH
T183136D4B960160B3D4DD0AB135DEBF169EFB6A3817724CA3CBAB2E4415B04499E3ED07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3788	johandyk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\johandyk.exe	jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe
File created	C:\Windows\SysWOW64\johandy.dll	jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	johandyk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3788	1556	jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe	89
PID 1556 wrote to memory of 3640	1556	jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\johandyk.exe
  C:\Windows\system32\johandyk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605.exe.bat
Size 274B
SHA256 3200d8ebaccebaa6547df93a5b70f7157d521ffe18bb8b972150580c6c895ef5
MD5 86e8ad0656c8b4f05163845ce5ef3c10
SHA1 29a3c5d0f211fcc93088c0120215861c00b379d1
SHA512 ca00826a853bb8cac357fbde57b475d9c54876031a24cbc2586c4ed08305eafa59a2d258fb6d60173d44b2c0335b06a50cb59ad4c10405faf98d27565cb2dd55
TLSH
T1E9D02B5882E1826B0414F57F9D3413E8402588B827C93B090B30CECB024241CF3FB30A
MD5 SHA1 SHA512 TLSH

Submit Download

johandyk.exe

Path C:\Windows\SysWOW64\johandyk.exe
Size 44KB
SHA256 53a4a45b402d0c9c704ebce1d61d0be580d48494db631382129ab01a5c2ca605
MD5 657bf97588d8a2ba50f24a744dcf7867
SHA1 8d053cd6d4532b296999f54ef5efbf2148952571
SHA512 d48bc7b3da82ea053d8bc33a6380dca9079bc04df14f2de71e6b40fd64bdda32241c5141a4a3faf319e13c8276db188f05d6f071321e7530e3367df090f26fb8
SSDEEP 384:+O0qEn6Y1EvqFGQ3RF5kjFy3xA73LEFsOEnBa28rGJ12wWfzB2pct5KHh:h0n6K4qFGQhF5kpiljEnUrGbWfzoat5
TLSH
T183136D4B960160B3D4DD0AB135DEBF169EFB6A3817724CA3CBAB2E4415B04499E3ED07
MD5 SHA1 SHA512 SSDEEP TLSH