9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe
Size 44KB
Sample261002-g7d33aba47
SHA256 9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2
MD5 5fa3ada4bad5b103b55754b17f63a7bd
SHA1 32e5308dedb12c3d637b5d01b98293c64fbc7ad3
SHA512 5232255feefabb4cf6881ea0a6414b4e51ffa45a98f6eebee5b33660a7da88d852aa86194de9a1347c50460af649e65839a4f0d2bba349c9621be229380ea4cf
SSDEEP 384:ihHhowZdPvNgV9+NXQMBivG/RCcYymr4KSpct5LooaZvb:GLPnNgV9bKx/RCcYymr4dat5paZv
TLSH
T1E7132B4B2711C8F2C3AA417479565A3A8B7FAC3503A39E93CB7359C99E201E86D3512F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4688	aotopptk.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\aotopptk.exe	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe
File opened for modification	C:\Windows\SysWOW64\aotopptk.exe	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe
File created	C:\Windows\SysWOW64\aotoppt.dll	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2912	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aotopptk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4688	4596	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe	86
PID 4596 wrote to memory of 2912	4596	jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe	101

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\SysWOW64\aotopptk.exe
  C:\Windows\system32\aotopptk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2.exe.bat
Size 274B
SHA256 6aa34a78d390c59b39dc94cdb27763e7b72b3cc6d874954699d9678d1e619b00
MD5 b734738ea1802db5f3bde9f00bd07e1e
SHA1 efee54c68c51d307d4215dbcfe1f0973087d0322
SHA512 3d63ffc7a4d2f0e2695ff87ff8a6f9cbc6d9e2e2b56ff926ff8860715bef314aee4fd17f151c0e2ba60416e16262a1aff1fa3e5620e0cd25c33c71272dd5a6bd
TLSH
T189D02B60B0654A678C02C8BF41B02389DC7DCD9815482F510D72DD84B0A460AB386704
MD5 SHA1 SHA512 TLSH

Submit Download

aotopptk.exe

Path C:\Windows\SysWOW64\aotopptk.exe
Size 44KB
SHA256 9dcb1885a79ea32d7ee53b5459492440936de94f0a0ee1eb8e9b9321a041a0b2
MD5 5fa3ada4bad5b103b55754b17f63a7bd
SHA1 32e5308dedb12c3d637b5d01b98293c64fbc7ad3
SHA512 5232255feefabb4cf6881ea0a6414b4e51ffa45a98f6eebee5b33660a7da88d852aa86194de9a1347c50460af649e65839a4f0d2bba349c9621be229380ea4cf
SSDEEP 384:ihHhowZdPvNgV9+NXQMBivG/RCcYymr4KSpct5LooaZvb:GLPnNgV9bKx/RCcYymr4dat5paZv
TLSH
T1E7132B4B2711C8F2C3AA417479565A3A8B7FAC3503A39E93CB7359C99E201E86D3512F
MD5 SHA1 SHA512 SSDEEP TLSH