23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe
Size 44KB
Sample260924-m8ptvacb49
SHA256 23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b
MD5 ae72286ed681a27f93224c19a30af0f5
SHA1 a3acfdbb4fe7b86b86169a6599624380707b10ca
SHA512 ccda20ef5c9d15db526394aec9666be463d9e13a58d65bbc0be4a17dae580798ca42f0bcb2fa9b8aeb2aaeff37b099af50685effa8b9f8146baaa8e3ee91c495
SSDEEP 384:B27v3vMgFgLsM/3Cy5JuEzv2L3lSo70wpJN8wYmQe80IccC:BCHMgFeV/3Cy5J7zv2L3V7Dh3QeTI9C
TLSH
T16013716E6530CC73C35E46FD68CE552B2DA7AC682215CF82EE2B45A89E34DD40C3A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1504	oanlexk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oanlex.dll	jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe
File created	C:\Windows\SysWOW64\oanlexk.exe	jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oanlexk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1504	2104	jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe	88
PID 2104 wrote to memory of 1240	2104	jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\oanlexk.exe
  C:\Windows\system32\oanlexk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b.exe.bat
Size 274B
SHA256 ddc10f8155db1d8139d249bdd3950e35bdba2f5020926bdf80e9df4916902f9b
MD5 cbe7b2055175bbc9aa895728815400d8
SHA1 f75495225f25c5d191a3472544ff62d0e3ed413a
SHA512 cbfb2d15a5c538d8c507c712126483e162e86081ab0455e51a0c8f74a700a5f629b76450e64af44426411a4cd5e03579b90144a83e54cd6c702d12b33f8582dc
TLSH
T1DDD02B7C41A2C1972C0AC51F05746A8DA010585827C8BF214512F1C121F384CF5C2E4B
MD5 SHA1 SHA512 TLSH

Submit Download

oanlexk.exe

Path C:\Windows\SysWOW64\oanlexk.exe
Size 44KB
SHA256 23703c5248c323e9bee7cc0d196a3e469aebb410e1a8cff599a5f08d3f9adb2b
MD5 ae72286ed681a27f93224c19a30af0f5
SHA1 a3acfdbb4fe7b86b86169a6599624380707b10ca
SHA512 ccda20ef5c9d15db526394aec9666be463d9e13a58d65bbc0be4a17dae580798ca42f0bcb2fa9b8aeb2aaeff37b099af50685effa8b9f8146baaa8e3ee91c495
SSDEEP 384:B27v3vMgFgLsM/3Cy5JuEzv2L3lSo70wpJN8wYmQe80IccC:BCHMgFeV/3Cy5J7zv2L3V7Dh3QeTI9C
TLSH
T16013716E6530CC73C35E46FD68CE552B2DA7AC682215CF82EE2B45A89E34DD40C3A50B
MD5 SHA1 SHA512 SSDEEP TLSH