4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe
Size 48KB
Sample260930-l5nlyaws7m
SHA256 4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e
MD5 9d77fb3c37fd57b65d2b6bba3094c52a
SHA1 3cc4dbd7cc62930a653a18b182ebf26c68f69a00
SHA512 d7f0c47abd745d3b08fe91c05abda2f306a92fc0541844b82afac44d8a1e53c291211d40df66fb09104d5a96e170cbe35453e89e2f1b6b113ec325e4f698b857
SSDEEP 384:HGI9TCaBwg4fsmrVqvqFVy6ijOz2GVI5g/gx6CA6L8gbQtFieIgjAmR:HvTv+g41JuqFVnbVUigxngcmi5XW
TLSH
T14B234B8F9520A8B2C6EE057432FEFB170E796E34515E98E3DAF31C895C3125B8929D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2696	cenbeznk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cenbezn.dll	jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe
File created	C:\Windows\SysWOW64\cenbeznk.exe	jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4508	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cenbeznk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2696	2832	jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe	89
PID 2832 wrote to memory of 4508	2832	jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\cenbeznk.exe
  C:\Windows\system32\cenbeznk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e.exe.bat
Size 274B
SHA256 9dc75db5881ed7ca7ff2524d40f9a35abb9409beb7e23f2112f226a3d64c2cd2
MD5 93137315ea6361a9f5b5d1d02f9c9748
SHA1 635ed3fabc92c3597b26b80878c0a07fe562d66c
SHA512 08ce0840495baf2fd6db4eeade3efc73576d4a6d1540beea3f51d9a42648609828d7362f5ddfd94488d7b21dd6a7c8f22e596c3256ad5702cf4adeb4c9f2a5ce
TLSH
T13ED02B81A056CE0A580CDA2F0A390B87A54305471BC82F171B1682D51271057F6B7217
MD5 SHA1 SHA512 TLSH

Submit Download

cenbeznk.exe

Path C:\Windows\SysWOW64\cenbeznk.exe
Size 48KB
SHA256 4c35d07db17fe014719ffb212247c7d95d290caccca2d6e7f7d1055180fa932e
MD5 9d77fb3c37fd57b65d2b6bba3094c52a
SHA1 3cc4dbd7cc62930a653a18b182ebf26c68f69a00
SHA512 d7f0c47abd745d3b08fe91c05abda2f306a92fc0541844b82afac44d8a1e53c291211d40df66fb09104d5a96e170cbe35453e89e2f1b6b113ec325e4f698b857
SSDEEP 384:HGI9TCaBwg4fsmrVqvqFVy6ijOz2GVI5g/gx6CA6L8gbQtFieIgjAmR:HvTv+g41JuqFVnbVUigxngcmi5XW
TLSH
T14B234B8F9520A8B2C6EE057432FEFB170E796E34515E98E3DAF31C895C3125B8929D07
MD5 SHA1 SHA512 SSDEEP TLSH