5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe
Size 48KB
Sample260930-ml969sxxfx
SHA256 5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c
MD5 78de94cc309d60ee8fd255502bcde59a
SHA1 12f83febcac9ada70c3159ace65aea7e5f1aa8c3
SHA512 37c6e7530e14921648759e6e252c217331ab6751111ad54086ce6f5473acd61da7060626c152d67b1a252e0556888457cff97452aa54d3e48202f0ca31e01d93
SSDEEP 384:btjpfDUXaJTj12vqFERXA0XpOaJcJ6XbkBuAqmgAChbs+crZMgFn:3fY+FaqFUQazO6XbaqxHEM
TLSH
T18B235B8F641224F2CAEE057035F9BB0A5EBF5E3841ADA0E3D9F30E495EB025B8551D07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1484	tldcocok.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tldcoco.dll	jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe
File created	C:\Windows\SysWOW64\tldcocok.exe	jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tldcocok.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 1484	3568	jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe	88
PID 3568 wrote to memory of 4924	3568	jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\SysWOW64\tldcocok.exe
  C:\Windows\system32\tldcocok.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c.exe.bat
Size 274B
SHA256 71e23133c768b1c1b6b6df1d351130719d17842f7dc3bc0cca759aa0344fc9e8
MD5 1038f1c4491dc9f529000a053d846ded
SHA1 b832b5e5aa0ffa08aee2f2d8efdadcc6088809c6
SHA512 e0db40c7265d772fd900f8176cd9aaf73c32fb479b3ef40c242ab7489da3bbc01ab76200e3fe10ff0d2f998c39b130eda1172f42cd193b887da14a6b39fd9830
TLSH
T113D02B94126BC7A91A84D83F0930038A413F08D02BD51F11C631C3D400AA21CB6F7B07
MD5 SHA1 SHA512 TLSH

Submit Download

tldcocok.exe

Path C:\Windows\SysWOW64\tldcocok.exe
Size 48KB
SHA256 5f64744823591d7af1a5bcc1ba7c927e6ec77d295d14d78bef041dcc3c42455c
MD5 78de94cc309d60ee8fd255502bcde59a
SHA1 12f83febcac9ada70c3159ace65aea7e5f1aa8c3
SHA512 37c6e7530e14921648759e6e252c217331ab6751111ad54086ce6f5473acd61da7060626c152d67b1a252e0556888457cff97452aa54d3e48202f0ca31e01d93
SSDEEP 384:btjpfDUXaJTj12vqFERXA0XpOaJcJ6XbkBuAqmgAChbs+crZMgFn:3fY+FaqFUQazO6XbaqxHEM
TLSH
T18B235B8F641224F2CAEE057035F9BB0A5EBF5E3841ADA0E3D9F30E495EB025B8551D07
MD5 SHA1 SHA512 SSDEEP TLSH