f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe
Size 48KB
Sample260924-fxca2sst2n
SHA256 f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff
MD5 448dcedf375ad2102884e7d9cb476a5d
SHA1 f86167b96bb8235ff3dee27141079b50860aadd0
SHA512 48199b6d3cdefff0923f74ecf20c61e93b30bdb67685a32fa52067ea36c8048a8dd4bbe13be520310088ab8107dfabba4290c7a7398a1218ba66fb3050580719
SSDEEP 384:nQkXmXpnYDaXk+vqFw3cXIh2r2fNP+bvPpP9aPnpcn/QFO6Tg:gOnSqFWcXIhOoPqvPpP9aPpcIFO6T
TLSH
T17B233BCFA45098F1CE1A06713ADAB7576FEB7E38319D50AFD3A785802CA040B7125E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4932	delnicek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\delnice.dll	jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe
File created	C:\Windows\SysWOW64\delnicek.exe	jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	delnicek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 4932	484	jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe	90
PID 484 wrote to memory of 5260	484	jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484
- C:\Windows\SysWOW64\delnicek.exe
  C:\Windows\system32\delnicek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff.exe.bat
Size 274B
SHA256 b619626feda4419c5bad8b4aec56af7d91eba51d6302504487274c45f9fd1649
MD5 8f6d007d8b1691da868db77a63c4a74b
SHA1 0218e28f41b3db5f9a763ceadb8e35af91680dc1
SHA512 bd9c12c156a5dea52e05affd11e6d38d05b44fe0132dce3343e7d242ba4383f22d204da491a9902f53b5271333672b5c1d21e44ca719d61aa018d3a23456ef18
TLSH
T124D02B44E073C2F62988D11B08391645B050C5A836483F96021167EC7292004E2C1394
MD5 SHA1 SHA512 TLSH

Submit Download

delnicek.exe

Path C:\Windows\SysWOW64\delnicek.exe
Size 48KB
SHA256 f9cc26a7e15646593801984ab2f6709114eebe0ff922520e487bac0628560dff
MD5 448dcedf375ad2102884e7d9cb476a5d
SHA1 f86167b96bb8235ff3dee27141079b50860aadd0
SHA512 48199b6d3cdefff0923f74ecf20c61e93b30bdb67685a32fa52067ea36c8048a8dd4bbe13be520310088ab8107dfabba4290c7a7398a1218ba66fb3050580719
SSDEEP 384:nQkXmXpnYDaXk+vqFw3cXIh2r2fNP+bvPpP9aPnpcn/QFO6Tg:gOnSqFWcXIhOoPqvPpP9aPpcIFO6T
TLSH
T17B233BCFA45098F1CE1A06713ADAB7576FEB7E38319D50AFD3A785802CA040B7125E17
MD5 SHA1 SHA512 SSDEEP TLSH