59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe
Size 52KB
Sample260925-2fj58ayapc
SHA256 59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3
MD5 9db15d9e424ccb217d34ab5489d65c21
SHA1 67933821351b9876159a2cf63cfadf1dc9ca6360
SHA512 72cb02ad10f9c4f95822958980c34a6095de45f83935162cfbda0730552d52fd7b7e78e3c5c07984ce3eb75fd2007d0d2d6ef126ec6bfd324b5e48aa64139527
SSDEEP 768:eDD7T51RWFDRSYp1CImdlRPpPdTPauHV9Sgrv:eX7T518NRRjCZ/19S
TLSH
T16B332C4A5C20E8F2DFDA05343996AE1B59EE5C34325840FBD32B6488FCA8B0F6561D17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2396	delnice

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\delnice.dll	jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe
File created	C:\Windows\SysWOW64\delnice	jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	delnice
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 2396	6076	jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe	89
PID 6076 wrote to memory of 2984	6076	jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\SysWOW64\delnice
  C:\Windows\system32\delnice ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3.exe.bat
Size 274B
SHA256 8c3d2b5a2bbeff9d9766c83a204cc077070bba341ac9080d9ac3484c0af6b55e
MD5 277f3f2d1f50f56d5c965085a9f0ba95
SHA1 5353a8b653074e78986e1bf525b9f5073c4e28a6
SHA512 4e95250723178c66190677cc64c6c093d6e003c356e2ee36a3c3daf0fd0c40e6171605479a76bc5f2aa79e4d0ccfa3367081a39483d47abf641b5d617470bac8
TLSH
T1A8D02B8545D6CF138458CC7F5929161FA10125AE2BCD2BD6062283D8155335AF6C2B45
MD5 SHA1 SHA512 TLSH

Submit Download

delnice

Path C:\Windows\SysWOW64\delnice
Size 52KB
SHA256 59064c7a8ba1b5045b2bc2d971f0535555b92991010ea61c2ed41d1c6cfb1de3
MD5 9db15d9e424ccb217d34ab5489d65c21
SHA1 67933821351b9876159a2cf63cfadf1dc9ca6360
SHA512 72cb02ad10f9c4f95822958980c34a6095de45f83935162cfbda0730552d52fd7b7e78e3c5c07984ce3eb75fd2007d0d2d6ef126ec6bfd324b5e48aa64139527
SSDEEP 768:eDD7T51RWFDRSYp1CImdlRPpPdTPauHV9Sgrv:eX7T518NRRjCZ/19S
TLSH
T16B332C4A5C20E8F2DFDA05343996AE1B59EE5C34325840FBD32B6488FCA8B0F6561D17
MD5 SHA1 SHA512 SSDEEP TLSH