689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe
Size 56KB
Sample260924-3t6rtavdmb
SHA256 689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f
MD5 f02340571f530e764c8ba69b57874888
SHA1 cfd852c4558625b37237f51f124f3037cd216109
SHA512 19ff4c16e9f89112381e5893782687eb4b6ff785f574ac47d2ea35620e5d8cb39db85ac25b5be0a81b32cef9a5a83ec7ea9c97e20cc41e7ca83c6391b9dbbede
SSDEEP 384:zACnXFisvNgs30Pba3dp3de3ea+PK3oSvNS3+o8WI4Vte/Qpct5t9999+FG:klwNgs5xe3eafPvNSD8W9w/Qat5YF
TLSH
T1DE43F7177660C4B1D08E46B4AFD2D0F61AE73EBA2956F1D27A53334C08F15978A1AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1392	mssetdk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mssetd.dll	jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe
File created	C:\Windows\SysWOW64\mssetdk.exe	jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2096	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mssetdk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1392	1984	jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe	90
PID 1984 wrote to memory of 2096	1984	jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe	91

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\mssetdk.exe
  C:\Windows\system32\mssetdk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f.exe.bat
Size 274B
SHA256 2e05962de572eab0ad64cb83854d91d054568276f094af48ba70e0e0763e3401
MD5 a9f4becce1fa10ce23b9ac03db7e71ac
SHA1 3d80ff5c6c9c17bd2ef34b345706ebb966e48974
SHA512 2cd08ec64db7ed47e42275c6164fb8d871df59feb7ccc7dbf506a37f48b7f329211127cfbaa330c472bb0e2a39aa2062937ce765dda96d917d7419210be3ae04
TLSH
T1EAD02B85B19ACDC25D8CC6FF1A3505DFC3204A106ACE2B164721818023F1605F1B2744
MD5 SHA1 SHA512 TLSH

Submit Download

mssetdk.exe

Path C:\Windows\SysWOW64\mssetdk.exe
Size 56KB
SHA256 689e01fc61082eab46316203a7a80144c854d024943e9db61548fca33d0e717f
MD5 f02340571f530e764c8ba69b57874888
SHA1 cfd852c4558625b37237f51f124f3037cd216109
SHA512 19ff4c16e9f89112381e5893782687eb4b6ff785f574ac47d2ea35620e5d8cb39db85ac25b5be0a81b32cef9a5a83ec7ea9c97e20cc41e7ca83c6391b9dbbede
SSDEEP 384:zACnXFisvNgs30Pba3dp3de3ea+PK3oSvNS3+o8WI4Vte/Qpct5t9999+FG:klwNgs5xe3eafPvNSD8W9w/Qat5YF
TLSH
T1DE43F7177660C4B1D08E46B4AFD2D0F61AE73EBA2956F1D27A53334C08F15978A1AF0B
MD5 SHA1 SHA512 SSDEEP TLSH