3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe
Size 44KB
Sample261002-hasevssfld
SHA256 3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441
MD5 0d0b73b284c50f58e22f1823da79f67d
SHA1 339ed9af33e963ed8fb66b0890b4f02baf491ac2
SHA512 646f822543719fc7ae6d136be6e0df0c424e7f809a3007c88ff3ed3cfe460917f06c7e43a5364441bc3dfe33df9be7a342fd155fabfc5f97127af423b29e4b91
SSDEEP 384:oq21oyM421MqvqF5B79oUB0v3TyCKC9/LDRuOZlipct5:LbbMuqFP79eTybC9/LDRuOZUat5
TLSH
T1F3136D0A690364B2C5DF0534358A96179BBE1C3476F60ADBCA57A9CC7D3086ADC39F06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5760	catowerk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\catowerk.exe	jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe
File created	C:\Windows\SysWOW64\catower.dll	jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	catowerk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 5760	448	jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe	91
PID 448 wrote to memory of 4612	448	jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448
- C:\Windows\SysWOW64\catowerk.exe
  C:\Windows\system32\catowerk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441.exe.bat
Size 274B
SHA256 eb5d4b56942d91e2c15c5a8e926657de7f76e3c39742f03a8b029ec5f446e22e
MD5 0670d84c27cc84bdc83ea28bbb8adebe
SHA1 b80216e64934dcc41ac3286ac7ed0731a7c94c2b
SHA512 6841446c62735e4833c68f5cea1d048d421725ee69661959d274178ee5be5acb546cd427561df4c4e76ae48a0e6f41334cd4cf671d6c26e8aafb1eeb6671968f
TLSH
T117D02B60016F8869DC24961B05340AEA87210E753BCD3F135A9247C45253004A5E3210
MD5 SHA1 SHA512 TLSH

Submit Download

catowerk.exe

Path C:\Windows\SysWOW64\catowerk.exe
Size 44KB
SHA256 3c4175c3ad9efca76e6e1c25c27d1f1b0eff982447b76cdcfdc686458c777441
MD5 0d0b73b284c50f58e22f1823da79f67d
SHA1 339ed9af33e963ed8fb66b0890b4f02baf491ac2
SHA512 646f822543719fc7ae6d136be6e0df0c424e7f809a3007c88ff3ed3cfe460917f06c7e43a5364441bc3dfe33df9be7a342fd155fabfc5f97127af423b29e4b91
SSDEEP 384:oq21oyM421MqvqF5B79oUB0v3TyCKC9/LDRuOZlipct5:LbbMuqFP79eTybC9/LDRuOZUat5
TLSH
T1F3136D0A690364B2C5DF0534358A96179BBE1C3476F60ADBCA57A9CC7D3086ADC39F06
MD5 SHA1 SHA512 SSDEEP TLSH