45cdb5628a0457e7c50d9eefb086baeaa763a94f7cbe3e2be3dd3f529c599ffc

Analysis

max time kernel
12s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Delf.hk.exe
Size 99KB
Sample261018-ymmcdast2r
SHA256 45cdb5628a0457e7c50d9eefb086baeaa763a94f7cbe3e2be3dd3f529c599ffc
MD5 899f5df411a8f75ddf8317ae053638da
SHA1 8c1b438dc1b2dc886407497245476ac5721d028c
SHA512 af0600bc8202442ca6206f3ef828d9a3f71e7c8c5e8688ec4d3da381d1f443d35d4d258c90e97b1662e9aa63fe636009af17505cacbc2f168c6eeca5c1985bf3
SSDEEP 1536:B67AMUOL98EGGic94XO1Wrlx0eVbkkkM8tF3QsG9O4GIGH1CqAKp:ESOL98EGGgCc8Fk1QF3t2O40Hcq
TLSH
T1FDA3128DB448DCC1C409DE75972EAB64665EE5228E36C7F11F2882882D372B5B7ED02C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Delf.hk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4052	3584	jaffacakes118_Trojan.Win32.Delf.hk.exe	89
PID 4052 wrote to memory of 4952	4052	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.hk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Delf.hk.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c a.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup microsoft.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a.bat

Path C:\Users\Admin\AppData\Local\Temp\a.bat
Size 27B
SHA256 9e96175a68fde649b2c15658866d50c295457e1e0ba819013168de8fd0ec6efb
MD5 353871260984a5d031fc02621472d08a
SHA1 43f43273add3c6e8b03b4323af7ea4f0786c89b4
SHA512 120915b0fa46b4b5f91a8ef67d291dd89c2bb19a725b3e1fc090ba790b693f7e63377cdc35e0c7c969ddbb5b51c5e973ef54e89fc32335580c40fa0af58f6611
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\ns
Size 120B
SHA256 25966e254ccbbfd093ae974cb0b6426ef3d62f3bdf0436eb7491383d49f88b63
MD5 dda3e1c1ff3c06e5fa7618f2344b291c
SHA1 6fb5a636eb0bd50ddc0f48aedf350158f88c5d2c
SHA512 449ce76337bd9ef8ba748ddf6882ecbefa50b1041fdb55994b6c0dc275d000180388fa73abe6e532ae21da84b5161e24bef468b8b4b0fb5bf2f92bc89c7d42cb
TLSH
T124B092BA830A54611AE0986526B15240A12631E9818468543A8CC03802A13B8FB935E8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3584-0-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/3584-5-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/3584-1-0x0000000000508000-0x0000000000509000-memory.dmp

Download

memory/3584-9-0x0000000000400000-0x0000000000509000-memory.dmp

Download

memory/3584-10-0x0000000000400000-0x0000000000509000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads