6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe
Size 44KB
Sample260924-3kl12svcjb
SHA256 6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753
MD5 09e2b915b9055123eace35b529aa56e4
SHA1 6ebeb0ef3dc489ac8739bf22eedf399916ee23fc
SHA512 49dba2de7f2ddea31ddfa3f52296253e996efbdbb6fc2a29ac49f7aa3a73c3dc678a5124db60528ee9de763eaa375a83ccb872a875bc4df3a39a218c7e39fc91
SSDEEP 384:BgDwTjViADWkXPRKQDAZui4DL1rapct5y6gdXm:BgkTxVDWTdZH4DL1+at5y6gd
TLSH
T1301329472B51D8F3D6DA45B9255A423F8BBA5D3113AB68D3CBB32EC49D700D84C3621B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
5884	momusik.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\momusi.dll	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe
File created	C:\Windows\SysWOW64\momusik.exe	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	momusik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3872	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe
3872	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 5884	3872	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe	89
PID 3872 wrote to memory of 4332	3872	jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\momusik.exe
  C:\Windows\system32\momusik.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753.exe.bat
Size 274B
SHA256 b9aa6df84c5b56251449998d2d11d0c98cf9ffcca2be2f2beb482a651fe124b6
MD5 11e43b2869e1e06d65eee87be9ae4718
SHA1 30e875b2a1b7155259eb3f8ed59c97e8a950b02a
SHA512 a9051d0bc9e6982025c00b301b04005080ea90463a636620e69660bf39e0476ec27cb1e4aa5fcd4cad37010acc6c6acd77e48f9f1f9d82f00fdf0d98217bee50
TLSH
T109D05B51454F4ED51659DC1F0A759D05401C1AC92EFF6F3D5231D6C9539142DF3D3249
MD5 SHA1 SHA512 TLSH

Submit Download

momusik.exe

Path C:\Windows\SysWOW64\momusik.exe
Size 44KB
SHA256 6f3c2c2f0e4d2cce93b2c71a10ad8124fbe61fddf422d7ac6c6f7d9548fae753
MD5 09e2b915b9055123eace35b529aa56e4
SHA1 6ebeb0ef3dc489ac8739bf22eedf399916ee23fc
SHA512 49dba2de7f2ddea31ddfa3f52296253e996efbdbb6fc2a29ac49f7aa3a73c3dc678a5124db60528ee9de763eaa375a83ccb872a875bc4df3a39a218c7e39fc91
SSDEEP 384:BgDwTjViADWkXPRKQDAZui4DL1rapct5y6gdXm:BgkTxVDWTdZH4DL1+at5y6gd
TLSH
T1301329472B51D8F3D6DA45B9255A423F8BBA5D3113AB68D3CBB32EC49D700D84C3621B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download