5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe
Size 44KB
Sample260930-l4pgvaydjb
SHA256 5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1
MD5 62a76502db8b5831bf68811f6f6c5c86
SHA1 3cea94d75f06207e8d68dc3292a6cbf9a5d0f2db
SHA512 362f95339d56440ce8ea372598815210711c3788b7ef235801090e82acf061ce95d68b24450ee703417db3dc3526d8efabc1ae24b3b116643e1863a63f4ab0a6
SSDEEP 384:bkX0E8W7RvrtIlFcel2uplI+XKi2LvtXpct5GMj:bZE8CrtIlFcSplETLvlat5G
TLSH
T11F13188B6A21C8F3D38986B4779B172B1FAB6D3416A6CDD6DBA31BD57C208D05C32113
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4192	theraltek.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\theralte.dll	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe
File created	C:\Windows\SysWOW64\theraltek.exe	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	theraltek.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
880	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe
880	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4192	880	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe	89
PID 880 wrote to memory of 5556	880	jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\theraltek.exe
  C:\Windows\system32\theraltek.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1.exe.bat
Size 274B
SHA256 ad55e4fbc153e0344baae79786639f5d7cd9370af50e6d7efbb1676786fdf945
MD5 06024c736c47098b0ef4f8b8f4476f39
SHA1 71de235364a02cd0860411641a0acb9f93aec30a
SHA512 a3ecb84762e8219dc78335ea715347394a373dcc527783691c4ab618a98c03338c65ae9ba9731f60cabc8558757fcba19ea84538373b60fd2f6081316fd38baf
TLSH
T1FBD02BE4421ACF9A7C14DC0F4639128DC05515E7DDCC2B175E1151994160448FACA341
MD5 SHA1 SHA512 TLSH

Submit Download

theraltek.exe

Path C:\Windows\SysWOW64\theraltek.exe
Size 44KB
SHA256 5abf6480f3321acdd932a82efc8ea1f07c3acd84be9209f59576708e3885abf1
MD5 62a76502db8b5831bf68811f6f6c5c86
SHA1 3cea94d75f06207e8d68dc3292a6cbf9a5d0f2db
SHA512 362f95339d56440ce8ea372598815210711c3788b7ef235801090e82acf061ce95d68b24450ee703417db3dc3526d8efabc1ae24b3b116643e1863a63f4ab0a6
SSDEEP 384:bkX0E8W7RvrtIlFcel2uplI+XKi2LvtXpct5GMj:bZE8CrtIlFcSplETLvlat5G
TLSH
T11F13188B6A21C8F3D38986B4779B172B1FAB6D3416A6CDD6DBA31BD57C208D05C32113
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download