45cdb5628a0457e7c50d9eefb086baeaa763a94f7cbe3e2be3dd3f529c599ffc

Analysis

max time kernel
18s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Delf.hk.exe
Size 99KB
Sample261018-ymmcdast2r
SHA256 45cdb5628a0457e7c50d9eefb086baeaa763a94f7cbe3e2be3dd3f529c599ffc
MD5 899f5df411a8f75ddf8317ae053638da
SHA1 8c1b438dc1b2dc886407497245476ac5721d028c
SHA512 af0600bc8202442ca6206f3ef828d9a3f71e7c8c5e8688ec4d3da381d1f443d35d4d258c90e97b1662e9aa63fe636009af17505cacbc2f168c6eeca5c1985bf3
SSDEEP 1536:B67AMUOL98EGGic94XO1Wrlx0eVbkkkM8tF3QsG9O4GIGH1CqAKp:ESOL98EGGgCc8Fk1QF3t2O40Hcq
TLSH
T1FDA3128DB448DCC1C409DE75972EAB64665EE5228E36C7F11F2882882D372B5B7ED02C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Delf.hk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3952	1484	jaffacakes118_Trojan.Win32.Delf.hk.exe	84
PID 3952 wrote to memory of 2752	3952	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.hk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.hk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup microsoft.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.bat

Path C:\Users\Admin\AppData\Local\Temp\a.bat
Size 27B
SHA256 9e96175a68fde649b2c15658866d50c295457e1e0ba819013168de8fd0ec6efb
MD5 353871260984a5d031fc02621472d08a
SHA1 43f43273add3c6e8b03b4323af7ea4f0786c89b4
SHA512 120915b0fa46b4b5f91a8ef67d291dd89c2bb19a725b3e1fc090ba790b693f7e63377cdc35e0c7c969ddbb5b51c5e973ef54e89fc32335580c40fa0af58f6611
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\ns
Size 120B
SHA256 771e7e748b0b6c437f8147d774f3692752e1ff501d835e52c31b17cc6785bbb2
MD5 98562ea9e0e188887c95babee0aa780a
SHA1 b8bca55fcd1551a5952be6a577d7202c0b5a64f5
SHA512 de4cbf9e18f002196a5c5c8b4bddf0ec9e1d7f14d9de9d1a7eb092ab03d80aeb91a7ba174cda27fee6a95c72e63f94a93ab10051f2b692e6afccb33750b9b328
TLSH
T132B092BA830A55211AE099A526B15280A12231D9818464943A8DD03402A13A8FB935E8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1484-0-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/1484-4-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/1484-2-0x0000000000508000-0x0000000000509000-memory.dmp

Download

memory/1484-8-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/1484-9-0x0000000000400000-0x0000000000509000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads