0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe
Size 48KB
Sample260925-2gtfaayara
SHA256 0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07
MD5 2bca1284907ae842336551216fb3ecf5
SHA1 960871f6153d86833c31a9b698c976c31ddc23b0
SHA512 e0c90c0671c965225ce0bb45729e31727d3ef580d1e5c1c43ecf1061a1b83a7527178305b10aa44b1a3a29c558062def4858322ebe5deff1b42a0317ba3f4ffe
SSDEEP 768:pR73PHvqFBaMcjgPhwVcToTHiJTzIrWS5G:pR7/HCKMcjr2Ir
TLSH
T10C23394B57006DF2CAD902B93997BB2B6BFF5D34133560EBD2E3988C583689B44A4D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4916	squalnek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\squalne.dll	jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe
File created	C:\Windows\SysWOW64\squalnek.exe	jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	squalnek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4916	4472	jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe	90
PID 4472 wrote to memory of 4944	4472	jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\squalnek.exe
  C:\Windows\system32\squalnek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07.exe.bat
Size 274B
SHA256 997e59fa54bc6509aa23d89251ac9f74fcfc216fb9835e4251a988db537091c8
MD5 ef416e4f6a0c7060ce221ce591a4585f
SHA1 8eecc9ede68e0f3b2e20efaad2d4607be55faefe
SHA512 216c977ffd3f37cd0150cbbd55a83927bca3af137060de776b7e58a005be55aef24da7e504233ad97594420f49c48eec41490335ebc1e6072689ff5cc0937210
TLSH
T145D02B40C04678E92C50DE2B21388B8951A827AC3AD9EF244736C1D67183428F3C270C
MD5 SHA1 SHA512 TLSH

Submit Download

squalnek.exe

Path C:\Windows\SysWOW64\squalnek.exe
Size 48KB
SHA256 0d9e54a03e89738578f7fd113b467941342ae5db64dfd427294c5725ec0a1f07
MD5 2bca1284907ae842336551216fb3ecf5
SHA1 960871f6153d86833c31a9b698c976c31ddc23b0
SHA512 e0c90c0671c965225ce0bb45729e31727d3ef580d1e5c1c43ecf1061a1b83a7527178305b10aa44b1a3a29c558062def4858322ebe5deff1b42a0317ba3f4ffe
SSDEEP 768:pR73PHvqFBaMcjgPhwVcToTHiJTzIrWS5G:pR7/HCKMcjr2Ir
TLSH
T10C23394B57006DF2CAD902B93997BB2B6BFF5D34133560EBD2E3988C583689B44A4D07
MD5 SHA1 SHA512 SSDEEP TLSH