14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe
Size 48KB
Sample260925-w34kgstdje
SHA256 14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277
MD5 35b2cc6df218a28431101ad8b0580838
SHA1 04dfe838b0ec4d04c0c34515a3e0eb7f1ab5aef0
SHA512 178aa46638fcb25ddef7b368b7c7512298ecaca385c43190e79838e9061d663d69a6268c0d889b3a722e48d593d55402fddc0d0aa70fc953be657b8c9f08abd4
SSDEEP 384:lBEP/ms2312vqFssllnF85aTw+g2kK6xPlPuTPyoKNG:/O/AFaqFssllF8YT82yxPlPuTPyoKk
TLSH
T175233B4F961158B1D5DE0A793AD679036AFF0C3835B95097DBA3588C2D6C84FA6C8E03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1148	jolendsk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\jolends.dll	jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe
File created	C:\Windows\SysWOW64\jolendsk.exe	jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jolendsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1148	2852	jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe	89
PID 2852 wrote to memory of 3896	2852	jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\jolendsk.exe
  C:\Windows\system32\jolendsk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277.exe.bat
Size 274B
SHA256 2f8a60d2515b3cc483289c412ce5b395bd42af06bb42430983e44049913e35b4
MD5 b96bea7df9d4acc6d623e2df4a4a5822
SHA1 fd83abae4f87d7798b94880980770ea8192be83c
SHA512 dd54db59389b8483b87ac0b9d4f33d831444274e8f3e85ea275fda98a93b84c4eab2eee2e03c2f7c5a4b7757da3a5b2f21cc30af9e6caa20476eb050904f1d97
TLSH
T150D02BE0C283461C3441D68F86A8975D9027B85C354C1F65FE25C0E831D243571A2F0C
MD5 SHA1 SHA512 TLSH

Submit Download

jolendsk.exe

Path C:\Windows\SysWOW64\jolendsk.exe
Size 48KB
SHA256 14bc481e4a8e9af044840a3215ff1336aa7966da6dd8654766e84a419245b277
MD5 35b2cc6df218a28431101ad8b0580838
SHA1 04dfe838b0ec4d04c0c34515a3e0eb7f1ab5aef0
SHA512 178aa46638fcb25ddef7b368b7c7512298ecaca385c43190e79838e9061d663d69a6268c0d889b3a722e48d593d55402fddc0d0aa70fc953be657b8c9f08abd4
SSDEEP 384:lBEP/ms2312vqFssllnF85aTw+g2kK6xPlPuTPyoKNG:/O/AFaqFssllF8YT82yxPlPuTPyoKk
TLSH
T175233B4F961158B1D5DE0A793AD679036AFF0C3835B95097DBA3588C2D6C84FA6C8E03
MD5 SHA1 SHA512 SSDEEP TLSH