cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe
Size 44KB
Sample261002-g8a3ssvxdx
SHA256 cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6
MD5 bb2f4e4890a4c4f399a98ac305bbc230
SHA1 54042db4d09ab0f8e4f2efbf15a939d917029918
SHA512 bafe0b2e1d0848bd4b8b7eae878cd388ddd38122b9f5d26c133b01f08ca87b530c50efce49b1c78aebef06d5857a0b71157416212f010cf267a3b46322ab0c4d
SSDEEP 384:cowN9FvNg4Lo3q8MxJBxL5DGYD02htlk0pct5Q:8zNNg5OzDGYD5htrat5Q
TLSH
T1C8135A479B409CF2E3CA457636470B772BEF69300766AC93CBA399C55C31AE81E36243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
3660	nvipatk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nvipat.dll	jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe
File created	C:\Windows\SysWOW64\nvipatk.exe	jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4140	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nvipatk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3660	2352	jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe	90
PID 2352 wrote to memory of 4140	2352	jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\nvipatk.exe
  C:\Windows\system32\nvipatk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6.exe.bat
Size 274B
SHA256 624cd911201f09aeff14d18099f46734f35144f214c2f39fb8a5b1c0e2ba4a33
MD5 5b79eb04d1cf6f9a528726bbbf528d52
SHA1 21c8232aa64cb30592f751b18117566dadb9ba17
SHA512 75bf62677efe85e8e668d0c198853159ed77415fde7c3515bf444e6518c7a64d79ea4aad1d83e3a8eb3a1975f6607be6d1eef9db2b923f898ebf92cd32fff2df
TLSH
T130D02B8250CB8236CC30C24F406223CAC1411DF8EE862E115632C1AF8250835F1D1F88
MD5 SHA1 SHA512 TLSH

Submit Download

nvipatk.exe

Path C:\Windows\SysWOW64\nvipatk.exe
Size 44KB
SHA256 cd2f34be91350763994ae631db2c4a556de5ecc8d0c0c680f9e7703c85ca82e6
MD5 bb2f4e4890a4c4f399a98ac305bbc230
SHA1 54042db4d09ab0f8e4f2efbf15a939d917029918
SHA512 bafe0b2e1d0848bd4b8b7eae878cd388ddd38122b9f5d26c133b01f08ca87b530c50efce49b1c78aebef06d5857a0b71157416212f010cf267a3b46322ab0c4d
SSDEEP 384:cowN9FvNg4Lo3q8MxJBxL5DGYD02htlk0pct5Q:8zNNg5OzDGYD5htrat5Q
TLSH
T1C8135A479B409CF2E3CA457636470B772BEF69300766AC93CBA399C55C31AE81E36243
MD5 SHA1 SHA512 SSDEEP TLSH