e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 05:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe
Size 48KB
Sample260924-fp5bvsed95
SHA256 e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034
MD5 74d0439c45d5516f5e7995f36f24a5b0
SHA1 d7c860f43e35f40c5165484b33c3f7030ebe1ba7
SHA512 dc220d2c83d785a4cad081aa582f8ee3b20e91b49a068bb87d106fd7a563cc791b9975f07250805d4d4ca78230e06dfbdc179a686b1b8366d3f8fdac25bbd969
SSDEEP 768:TLHSOtSFIh4tUmjne17Ne06Fg9Aor1X+Sm81G:TmQnmjedNe06prSm8
TLSH
T186234B4F7451A8B2C5EE053831F9FB131A7DEE34A26984D3EAE75CCB59301178929E07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4836	qensngk.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qensngk.exe	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe
File opened for modification	C:\Windows\SysWOW64\qensngk.exe	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe
File created	C:\Windows\SysWOW64\qensng.dll	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qensngk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4836	4724	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe	84
PID 4724 wrote to memory of 560	4724	jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe	85

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\qensngk.exe
  C:\Windows\system32\qensngk.exe t!
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034.exe.bat
Size 274B
SHA256 82ffb7bbdff0c9df332f11383e170745eaf75308dbe689e87cf270ee4d8f92c1
MD5 4ceeacd316f3a50d1347c09596f06b0b
SHA1 9fde7d45176e8564d2be843a4fd6fd0c525d6259
SHA512 2d3f7d3f2dba7ab29e4e258ee7ad8c3e9b86117fd512107e7cae5bb355a5a42db792d22eb1bc93b904570e08a88c681202b91df8cbfd7368ccc94e40d30e92d7
TLSH
T19BD02BC0929E419AC400D17B0D393E8C92245FE42A8B3F020711C0DB605003DB5E1649
MD5 SHA1 SHA512 TLSH

Submit Download

qensngk.exe

Path C:\Windows\SysWOW64\qensngk.exe
Size 48KB
SHA256 e94ca212aa4054dd3aa87baa3eb0f9eaea89aa49b871b41625ab46ce674f7034
MD5 74d0439c45d5516f5e7995f36f24a5b0
SHA1 d7c860f43e35f40c5165484b33c3f7030ebe1ba7
SHA512 dc220d2c83d785a4cad081aa582f8ee3b20e91b49a068bb87d106fd7a563cc791b9975f07250805d4d4ca78230e06dfbdc179a686b1b8366d3f8fdac25bbd969
SSDEEP 768:TLHSOtSFIh4tUmjne17Ne06Fg9Aor1X+Sm81G:TmQnmjedNe06prSm8
TLSH
T186234B4F7451A8B2C5EE053831F9FB131A7DEE34A26984D3EAE75CCB59301178929E07
MD5 SHA1 SHA512 SSDEEP TLSH