2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe
Size 52KB
Sample260924-ftft3ass5r
SHA256 2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55
MD5 59a8cb6ba2424e2f717240bbe6dc8796
SHA1 afd03b280e8a8dc72f39285092708ec2ac8a2e96
SHA512 ae318b765dd6de79addd0474f151811d66f1e453f3e6e42e7a881667bd51309b80d18093a7318d43f60b8a86f4f692f8112278ee95321b6fe059cf4788a28b60
SSDEEP 384:EwPQhtldVervTFxurBJ7Vs3Osg5U15wwdECsSs0CxBOMA6IkOHLodxfCnAo+Hx:3PmlsTFxu1wToU15rd3srOwV91sAoA
TLSH
T160333B4B65427CF1C3AF003932FBBB1B19BA7E34F4995C93E5C7AA095D3410AD209D06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
6112	rexljehk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rexljeh.dll	jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe
File created	C:\Windows\SysWOW64\rexljehk.exe	jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3536	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rexljehk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 6112	1968	jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe	89
PID 1968 wrote to memory of 3536	1968	jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\rexljehk.exe
  C:\Windows\system32\rexljehk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55.exe.bat
Size 274B
SHA256 9fed97ef2e8a1048a4af823ef63e7b648270736a2204a6f3fcad34823f45452c
MD5 bff4ce8525b9ab26477ffe28dcb55df5
SHA1 e72d05fd7fe58e36061dc459ab4607c3cc1208bf
SHA512 9f774cf7137dcb2418c51d354c4241be611f37120c6ee294e9bf5e4d62bc62787c65356572743c32d0d47af178f4dbbe25b1677c9371fedbd0eab4a866f2c84a
TLSH
T19DD02B8400B28CD1B84ED51F82E922CB4CB39A7091DD5E0A4B13D8C910E078471C3637
MD5 SHA1 SHA512 TLSH

Submit Download

rexljehk.exe

Path C:\Windows\SysWOW64\rexljehk.exe
Size 52KB
SHA256 2896a96ea8b38fceddcc47b37abb4fdea9d63a3b303de3a30348a911743e9b55
MD5 59a8cb6ba2424e2f717240bbe6dc8796
SHA1 afd03b280e8a8dc72f39285092708ec2ac8a2e96
SHA512 ae318b765dd6de79addd0474f151811d66f1e453f3e6e42e7a881667bd51309b80d18093a7318d43f60b8a86f4f692f8112278ee95321b6fe059cf4788a28b60
SSDEEP 384:EwPQhtldVervTFxurBJ7Vs3Osg5U15wwdECsSs0CxBOMA6IkOHLodxfCnAo+Hx:3PmlsTFxu1wToU15rd3srOwV91sAoA
TLSH
T160333B4B65427CF1C3AF003932FBBB1B19BA7E34F4995C93E5C7AA095D3410AD209D06
MD5 SHA1 SHA512 SSDEEP TLSH