15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe
Size 48KB
Sample260924-ggy1jsfc47
SHA256 15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e
MD5 19aba4f95d3246454beb171fa411109d
SHA1 73b3701e4c87b43128b187b56eefb5ac691fef29
SHA512 7b6433960b9d99ed7bbc5ee790b6c7c74c5055f98a8b8e1c0571be4f4ed555da24a56943ed53d3cb341d949460021040d990500f0a2862c176c3e503d6f00dbe
SSDEEP 384:sllBJGOP01xvqFulh8SrCHtARdezRzRwcCyjCII:oli8mJqFulhKGRozRzRw2jCII
TLSH
T11E233B4FB660C9B3C67D05343EA4F3B60AEF7C7026899493FAE3B76928744875125E06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2628	cenvtak.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cenvta.dll	jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe
File created	C:\Windows\SysWOW64\cenvtak.exe	jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cenvtak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 2628	3200	jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe	88
PID 3200 wrote to memory of 4644	3200	jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\SysWOW64\cenvtak.exe
  C:\Windows\system32\cenvtak.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e.exe.bat
Size 274B
SHA256 58d5550f857d62b65aabe38d10ec152fbc5262ad98a4384801ca2ca437143d49
MD5 82cbf9fa5008b4ba017b1df1e9688d84
SHA1 5db2454ea87ac9e776beef83da5aae1711b2e82b
SHA512 35e728dbf2dbd31a3fd45d91afccfc6e80c759a3824fcbb52aee38fc9c17c692e5e4d490eb51208a18886e498329774a02aaa9d3f8b50f5df5cb49e3f660b936
TLSH
T1A1D02B644052CB624402F92F48F50F0A961B4D4336CD7B214BA2C2D432B124A76A9705
MD5 SHA1 SHA512 TLSH

Submit Download

cenvtak.exe

Path C:\Windows\SysWOW64\cenvtak.exe
Size 48KB
SHA256 15e1e09405a82fa88126adc5d8babab6f800be8c7f10187768bb76b51c49cd2e
MD5 19aba4f95d3246454beb171fa411109d
SHA1 73b3701e4c87b43128b187b56eefb5ac691fef29
SHA512 7b6433960b9d99ed7bbc5ee790b6c7c74c5055f98a8b8e1c0571be4f4ed555da24a56943ed53d3cb341d949460021040d990500f0a2862c176c3e503d6f00dbe
SSDEEP 384:sllBJGOP01xvqFulh8SrCHtARdezRzRwcCyjCII:oli8mJqFulhKGRozRzRw2jCII
TLSH
T11E233B4FB660C9B3C67D05343EA4F3B60AEF7C7026899493FAE3B76928744875125E06
MD5 SHA1 SHA512 SSDEEP TLSH