c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe
Size 48KB
Sample260924-e1n9cayeqc
SHA256 c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02
MD5 59149b40ba58fce6f2c7841a7ce0abe9
SHA1 705b20e6cec8119384ec183b43c359bafc5488a5
SHA512 5e42a6a031e82fc4af8ee46f084565c4153031f46f42ee4e85c61c15d07ac0916b072913a016f5726247e6863c81b1ccd62b691fe875a3962f52b20a61b02f76
SSDEEP 768:dV1u8sTFotkQUZELXm3ezCR6VEPfGY99Kpn19lAJ:dTJ8gkpZELXm3ezCbCpnm
TLSH
T1432329477259C8B2C4DF02B93985EF6B5AB97E34069BD593B7E7B78919344038430E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1680	mcromvk.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mcromvk.exe	jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe
File created	C:\Windows\SysWOW64\mcromv.dll	jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mcromvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1680	4460	jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe	90
PID 4460 wrote to memory of 3664	4460	jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\mcromvk.exe
  C:\Windows\system32\mcromvk.exe ˜‰
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118_c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02.exe.bat
Size 274B
SHA256 a66ca4e68151f02bc1a1e7aed89d2a1af3d327590c8995cf761dec4ec7dc1a43
MD5 9f5dfabb10d97991443db658b67ac003
SHA1 3ae0e6b2124f52ef44f3b63d364a4cc1f4e330cf
SHA512 2843581ca816b8d3d1c18430df66ee51011e53b7718fa281e92380b9078d033e3030574ed86107ebb51e5ca9a500d451f037939f5e42f7f3f935f00a89c27bcc
TLSH
T172D0C240236DCD169C05B87B0CB0594C70310A47B6C52F202A32C6D020A310DE181FC4
MD5 SHA1 SHA512 TLSH

Submit Download

mcromvk.exe

Path C:\Windows\SysWOW64\mcromvk.exe
Size 48KB
SHA256 c3b844187f2afa4ee923f6cd8b93b0355837b51928a79669e48cf5254f661b02
MD5 59149b40ba58fce6f2c7841a7ce0abe9
SHA1 705b20e6cec8119384ec183b43c359bafc5488a5
SHA512 5e42a6a031e82fc4af8ee46f084565c4153031f46f42ee4e85c61c15d07ac0916b072913a016f5726247e6863c81b1ccd62b691fe875a3962f52b20a61b02f76
SSDEEP 768:dV1u8sTFotkQUZELXm3ezCR6VEPfGY99Kpn19lAJ:dTJ8gkpZELXm3ezCbCpnm
TLSH
T1432329477259C8B2C4DF02B93985EF6B5AB97E34069BD593B7E7B78919344038430E0A
MD5 SHA1 SHA512 SSDEEP TLSH